cve-resolver

name	cve-resolver
description	Resolve CVEs in rocks by updating dependencies in rockcraft.yaml, verifying with govulncheck and rockcraft, and creating specific conventional commits.

CVE Resolver Skill

This skill guides the process of addressing Common Vulnerabilities and Exposures (CVEs) in rockcraft projects.

Workflow

1. Identify CVEs

CVEs are typically reported via GitHub issues (e.g., https://github.com/canonical/openfga-rock/issues/59). Each issue will list the affected packages and the corresponding CVE IDs.

2. Update Dependencies

Address the CVEs by modifying rockcraft.yaml. There are two main approaches:

• Update Source Version: If a part's source-tag or source-branch can be moved to a patched version, update it there.
• Go Mod Replace: For Go-based parts, use go mod edit -replace within the override-build section to force a specific patched version of a sub-dependency.

Example override-build snippet:

    override-build: |
      # Addressing CVE
      go mod edit -replace go.opentelemetry.io/otel/sdk=go.opentelemetry.io/otel/sdk@v1.43.0
      go mod edit -replace google.golang.org/grpc=google.golang.org/grpc@v1.79.3
      go mod tidy
      # ... rest of the build commands

3. Verification

Run the following checks to ensure the quality and effectiveness of the changes:

• Vulnerability Check: If the part is Go-based, run govulncheck ./... within the part's context (if possible) or simulate the build to see if vulnerabilities persist.
• : Run to ensure a fresh environment.