path: root/bin/gen-DSA

#!/bin/sh

####################
#    Copyright (C) 2011 by Raphael Geissert <geissert@debian.org>
#
#
#    This file is free software: you can redistribute it and/or modify
#    it under the terms of the GNU General Public License as published by
#    the Free Software Foundation, either version 3 of the License, or
#    (at your option) any later version.
#
#    This file is distributed in the hope that it will be useful,
#    but WITHOUT ANY WARRANTY; without even the implied warranty of
#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#    GNU General Public License for more details.
#
#    You should have received a copy of the GNU General Public License
#    along with this file.  If not, see <http://www.gnu.org/licenses/>.
####################

set -e

OLDSTABLE=lenny
STABLE=squeeze
TESTING=wheezy

export LANG=C

[ -f doc/DSA.template ] || {
    echo "error: call this script from the root of the repository" >&2
    exit 1
}

[ $# -ge 2 ] || {
    echo "usage: $0 [--save] [DSA] package 'vulnerability desc' [cve(s) [bugnumber(s)]]"
    echo "       'DSA' is the DSA number, required when issuing a revision"
    echo "       'cve(s)' and 'bugnumber(s)' can be passed in any order but"
    echo "         always AFTER the description"
    echo "       If it doesn't like your bug number, prefix it with # and report"
    exit 1
} >&2

save=false
if [ "$1" = "--save" ]; then
    save=true
    shift
fi

toupper() {
    printf '%s' "$1" | tr '[:lower:]' '[:upper:]'
}

tolower() {
    printf '%s' "$1" | tr '[:upper:]' '[:lower:]'
}

split_n_sort() {
    printf '%s' "$1" | sed 's/[ ,;]+/ /g' | tr ' ' "\n" | sort -u |
    sort -n | tr "\n" ' ' | sed -r 's/\s+/ /g;s/\s$//'
}

warn() {
    printf "${YELLOW}warning:${NORMAL} %s\n" "$1"
}

notice() {
    printf "${MAGENTA}notice:${NORMAL} %s\n" "$1"
}

error() {
    printf "${RED}error:${NORMAL} %s\n" "$1"
}

check_spelling() {
    if which aspell >/dev/null && echo test | aspell -l en list 2>/dev/null; then
	aspell -l en list
    elif which enchant >/dev/null && echo test | enchant -l -d en 2>/dev/null; then
	enchant -l -d en
    fi
}

cleanup_vulnerability() {
    lastw=
    add_space=false

    for word in $@; do
	if [ -n "$lastw" ]; then
	    add_space=true
	fi

	case $word in
	    D[Oo]S)
		word="denial of service"
	    ;;
	    CSRF)
		word="cross-site request forgery"
	    ;;
	    XSS)
		word="cross-site scripting"
	    ;;
	    site)
		if [ "$lastw" = cross ]; then
		    add_space=false
		    word="-site"
		fi
	    ;;
	    [Nn]ull)
		word=NULL
	    ;;
	    out-of-bound|bound)
		word="${word}s"
	    ;;
	esac

	if $add_space; then
	    printf ' '
	fi

	lastw="$word"
	printf '%s' "$word"
    done
}

setvar() {
    local var="$1" value="$2"

    if [ -z "$value" ]; then
	value="$(eval 'printf "%s" "$'"$var"'"')"
    fi

    sed -i "s=\$$var=$value=g" "$tmpf"
}

if which tput >/dev/null; then
    RED=$(tput setaf 1)
    YELLOW=$(tput setaf 3)
    MAGENTA=$(tput setaf 5)
    NORMAL=$(tput op)
else
    RED=''
    YELLOW=''
    MAGENTA=''
    NORMAL=''
fi

DSAID=
if printf '%s' "$1" | grep -Eq '^(DSA-|)[0-9]+(-[0-9]+|)$'; then
    DSAID="${1#DSA-}"
    shift
fi

PACKAGE="$(tolower "$1")"
VULNERABILITY="$(cleanup_vulnerability "$2")"
shift 2

CVE=
BUGNUM=
REFERENCES=0
TEXT=

while [ $# -gt 0 ]; do
    case "$1" in
	[cC][vV][eE]-*)
	    CVE="$CVE $(toupper "$1")"
	;;
	[0-9][0-9][0-9][0-9][0-9][0-9]|[#][0-9]*)
	    BUGNUM="$BUGNUM ${1#\#}"
	;;
	*)
	    error "Don't know what to do with '$1' argument" >&2
	    exit 1
	;;
    esac
    shift
done

CVE="$(split_n_sort "$CVE")"
cve_spacing=

for i in $(seq 0 16); do
    cve_spacing="$cve_spacing "
done
sed_cmd='s/((CVE-[0-9-]+[ ]+){4})(.+)$/\1\\n'"$cve_spacing"'\3/g;P;D'
CVE_LIST="$(printf '%s' "$CVE" | sed -r "$sed_cmd")"

for id in $CVE; do
    REFERENCES=$(($REFERENCES+1))
    grep -wq "^$id" data/CVE/list || {
	warn "'$id' is not known" >&2
    }

    TEXT="$TEXT\n\n$id\n\n    Description"
done

if [ $REFERENCES -eq 1 ]; then
    TEXT=
fi

if [ -n "$TEXT" ]; then
    TEXT="Brief introduction $TEXT"
    
    if ! $save; then
	TEXT="The CVE ids will be listed here when --save'ing"
    fi
fi

case "$DSAID" in
    *-*|'')
	:
    ;;
    *)
	notice "missing DSA revision number, assuming 1" >&2
	DSAID="$DSAID-1"
    ;;
esac

dsa_exists() {
    grep -wq "DSA-$1" data/DSA/list
}

if [ -z "$DSAID" ]; then
    latest_dsa="$(sed -nr '/DSA-[0-9]+-1/{s/^.+DSA-([0-9]+).*$/\1/;p;q}' data/DSA/list)"
    dsa=$(($latest_dsa+1))
    c=0
    while dsa_exists "$dsa-1"; do
	dsa=$(($dsa+1))
	c=$(($c+1))
	if [ $c -eq 10 ]; then
	    error "unable to find an unused DSA id after $c attempts" >&2
	    error "to workaround specify an id as the first parameter" >&2
	    exit 1
	fi
    done
    DSAID="$dsa-1"
fi

if dsa_exists "$DSAID"; then
    error "DSA-$DSAID has already been used" >&2
    exit 1
fi

if echo "$VULNERABILITY" | grep -iq vulnerab; then
    warn "redundant vulnerability adjective/noun in vuln. summary" >&2
fi

if [ "$VULNERABILITY" = remote ] || [ "$VULNERABILITY" = local ]; then
    error "'$VULNERABILITY' is not a vulnerability summary" >&2
    exit 1
fi

echo "$VULNERABILITY" | check_spelling |
while read word; do
    # Frequent exceptions:
    case $word in
	SQL)
	    continue
	;;
    esac
    warn "possible spelling mistake: $word!" >&2
done

tmpf=$(mktemp)
cat doc/DSA.template > $tmpf

if [ "$VULNERABILITY" = regression ]; then
    sed -ri '/^Subject:/s/security update$/regression update/' $tmpf
fi

if [ $REFERENCES -gt 1 ]; then
    sed -ri 's/this problem has/these problems have/' $tmpf
fi

name_length=${#DEBFULLNAME}
spacing=$((24-$name_length))
SPACEDDEBFULLNAME="$DEBFULLNAME"
while [ $spacing -gt 0 ]; do
    SPACEDDEBFULLNAME=" $SPACEDDEBFULLNAME"
    spacing=$((spacing-1))
done

DATE="$(date +"%B %d, %Y")"
date_length=${#DATE}
spacing=$((22-$date_length))
SPACEDDATE="$DATE"
while [ $spacing -gt 0 ]; do
    SPACEDDATE="$SPACEDDATE "
    spacing=$((spacing-1))
done

setvar DEBEMAIL
setvar DEBFULLNAME
setvar SPACEDDEBFULLNAME
setvar PACKAGE
setvar CVE "$CVE_LIST"
setvar REMLOCAL "${REMLOCAL:-remote}"
setvar DSAID
setvar BUGNUM
setvar VULNERABILITY
setvar DEBIANSPECIFIC "${DEBIANSPECIFIC:-no}"
setvar OLDSTABLE
setvar STABLE
setvar TESTING
setvar SPACEDDATE
setvar DATE
setvar TEXT "${TEXT:-DSA text goes here}"

for dist in $OLDSTABLE $STABLE $TESTING UNSTABLE; do
    version="$(eval 'printf "%s" "$'"$dist"_VERSION'"')"
    if $save && [ -z "$version" ] && grep -q "${dist}_VERSION" "$tmpf"; then
	printf "Enter $dist's version [unset]: "
	read version
	if [ -n "$version" ]; then
	    eval "${dist}_VERSION='$version'"
	fi
    fi
    [ -z "$version" ] || setvar "${dist}_VERSION" "$version"
done

if ! $save; then
    cat $tmpf
    echo
    echo " ---- "
    echo "Pass --save as the first parameter to save the text to DSA-$DSAID"
    echo "(the data/DSA/list entry will also be added)"
    rm -f "$tmpf"
    exit
else
    mv -i $tmpf "DSA-$DSAID" || { rm -f $tmpf; exit; }
    dsa_entry=$(mktemp)
    cat <<EOF > $dsa_entry
[$(date +"%d %b %Y")] DSA-$DSAID $PACKAGE - $VULNERABILITY
EOF

    if [ "$CVE" ]; then
	printf "\t{%s}\n" "$CVE" >> $dsa_entry
    fi

    for dist in $OLDSTABLE $STABLE; do
	version="$(eval 'printf "%s" "$'"$dist"_VERSION'"')"
	[ -z "$version" ] || \
	    printf "\t[%s] - %s %s\n" "$dist" "$PACKAGE" "$version" >> $dsa_entry
    done
    tmp_list="$(mktemp)"
    cat $dsa_entry data/DSA/list > $tmp_list
    cat $tmp_list > data/DSA/list
    rm -f $tmp_list
    echo "DSA text written to ./DSA-$DSAID"
fi