Method and system for automatically repairing CVE vulnerability by Golang software package

Abstract

The invention discloses a method and system for automatically repairing CVE vulnerabilities through a Golang software package, and the method comprises the steps: maintaining and managing a version label value of the Golang software package through an introduced label mechanism in a Linux release version which uses an RPM package manager and an OBS compiling system; when a new Golang software package is introduced, the version of the Golang software package is upgraded and the CVE vulnerability of the Golang software is repaired, an OBS compiling system automatically triggers and recompiles the Golang software package through the change of a version label value, and the Golang software package is stored in an RPM software package warehouse, so that the automatic repair of the CVE vulnerability is realized. The method aims at solving the problem that configuration adaptation codes such as Loongson and SW attached to Golang software packages developed by using a Golang language are affected by CVE vulnerabilities, and the problems that when the number of the Golang software packages is large, CVE vulnerability maintenance complexity is too high, and manpower is consumed too much are solved.

Description

Technical Field

[0001] This invention pertains to the management and remediation mechanisms for CVE vulnerabilities, specifically relating to a method and system for automatically remediating CVE vulnerabilities using a Golang software package. Background Technology

[0002] CVE (Common Vulnerabilities and Exposures) is a cybersecurity term used to describe and identify known vulnerabilities and security risks in the field of information security. Golang, due to its high performance and cross-platform compatibility, has become a popular programming language in areas such as cloud computing, microservices, and distributed systems, and the number of software packages developed using Golang is increasing.

[0003] Loongson and Shenwei architectures are processor architectures independently developed in China. With the development of domestic substitution, more and more cloud computing infrastructures are adopting Loongson (LoongArch64) and Shenwei (SW_64) processors.

[0004] In the Golang community, most software packages developed using Golang only support Aarch64 and x86_64 architecture processors. To adapt to Loongson and Shenwei architecture processors, Linux distribution developers generally add a compressed vendor.tar file to their source code to support package building on Linux operating systems with Loongson and Shenwei architectures. Due to the design differences between Loongson and Shenwei architectures, a software package might provide separate architecture-adapted vendor.tar packages for Loongson and Shenwei architectures to support both. These packages contain a "vendor / golang.org / x" subdirectory containing various necessary sub-packages. Generally, the source code affecting architecture adaptation mainly consists of the Golang sys and sys / unix sub-packages. golang.org / x / sys is a collection of Go packages containing various system calls and low-level operating system interfaces, providing access to operating system functions, often not covered in the standard library. golang.org / x / sys / unix is ​​a sub-package within the sys package, specifically designed to provide Unix-related system calls and interfaces.

[0005] During the development of the Linux operating system, CVE vulnerabilities have posed a serious threat to information security. Similarly, during the evolution of Golang, issues such as code robustness may affect system stability and security, for example, CVE-2022-29526 and CVE-2022-41721 affecting the Golang sys / unix subpackage. To fix these CVEs, every Golang package with architecture-adapted source code needs to have its architecture-adapted source code patched. As the number of packages increases, the complexity of maintaining packages significantly increases, as does the manpower required, especially when packages provide architecture-adapted source code for Loongson and Shenwei architectures respectively. In the evolution of Linux distributions using RPM (RPM Package Manager) and OBS (Open Build Service) build systems, when CVE vulnerabilities are found in the Golang sys and / or unix modules, there is currently no method to automatically resolve CVE vulnerabilities for Golang packages adapted for Loongson and Shenwei architectures. Summary of the Invention

[0006] The technical problem to be solved by this invention is to provide a method and system for automatically repairing CVE vulnerabilities in Golang software packages, addressing the aforementioned problems in the prior art. This invention aims to solve the problem that the architecture adaptation code of Golang software packages developed using the Golang language, such as Loongson and Shenwei, is affected by CVE vulnerabilities, as well as the problem that maintaining CVE vulnerabilities is too complex and manpower-intensive when there are a large number of Golang software packages.

[0007] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows: A method for automatically patching CVE vulnerabilities in Golang packages includes the following steps: In Linux distributions using RPM package manager and OBS build system, version tag values ​​of Golang packages are maintained and managed through an introduced tag mechanism. When a new Golang package is introduced, a Golang package version is upgraded, or a CVE vulnerability in Golang software is patched, the change in version tag value causes the OBS build system to automatically trigger recompilation. The recompiled Golang package is then stored in the RPM package repository to achieve automatic patching of CVE vulnerabilities in Golang packages.

[0008] Optionally, the tagging mechanism introduced in Linux distributions using RPM package managers and OBS build systems includes a tag management macro package for building RPM packages. This RPM package tag management macro package includes the tag operation macro function `_golabel`, the sys subpackage replacement macro function `_copy_golang_sys`, the unix subpackage replacement macro function `_copy_golang_unix`, the sys_unix subpackage replacement macro function `_copy_golang_sys_unix`, and the storage path definition macro `_golabel_db`. The tag operation macro function `_golabel` is used for compiling Golan using OBS. When updating the `g` package, the `tag` database is read to update the `Release` value on the Golang package version number. The `sys` subpackage replacement macro function `_copy_golang_sys` is used by the Golang package's RPM package configuration file to replace the `sys` subpackage in the built-in architecture adaptation source code. Similarly, the `unix` subpackage replacement macro function `_copy_golang_unix` is used by the Golang package's RPM package configuration file to replace the `unix` subpackage in the built-in architecture adaptation source code. The `sys_unix` subpackage replacement macro function `_copy_golang_sys_unix` is used by the Golang package's RPM package configuration file to replace the `unix` subpackage in the built-in architecture adaptation source code. The configuration file of the RPM package replaces the sys and unix subpackages in the built-in architecture adaptation source code. The storage path definition macro `_golabel_db` defines the file storage path for the version label value database. The labeling mechanism also includes: adding a reference to the label operation macro function `_golabel` in the Golang package's configuration file `SPEC` to retrieve the version label value of the Golang package from the version label value database; and modifying the value of the official release version number `Release` in the Golang package's configuration file `SPEC` to update the version label value database with the version label value of the Golang package. The version tag value is appended to the base version number (Version) of the Golang package to avoid the need for subsequent updates to the version tag value in the Golang package's configuration file (SPEC). During the preparatory phase of building the Golang package (%prep), some or all of the macro functions _copy_golang_sys, _copy_golang_unix, and _copy_golang_sys_unix are called for the target architecture to replace the sys and unix subpackages in the adaptation code for the target architecture.

[0009] Optionally, each record in the version tag value database includes the package name of the Golang package and its corresponding version tag value, wherein the version tag value is in pure numeric format and ranges from [1, ∞).

[0010] Optionally, the version label value database is stored on the Git platform; after building the compilation environment, the OBS compilation system downloads the database file of the version label value database from the Git platform and stores it in the file path specified by the macro _golabel_db in the storage path definition.

[0011] Optionally, the maintenance and management of version tag values ​​for Golang packages through the introduced tag mechanism includes: Version tag value increment: When a Golang package completes the CVE vulnerability patching for the sys or unix subpackages, the webhook project configured in the code repository increments the version tag values ​​of all Golang packages in the version tag value database; Version tag value reset: When a package developed using the Golang language is upgraded, if the value of the basic feature version number (Version) or the official release version number (Release) without version tags changes, the webhook project configured in the code repository resets the version tag value of the Golang package recorded in the version tag value database to 1; Version tag value addition: When a new Golang package developed using the Golang language is introduced, the webhook project configured in the code repository checks the Golang package's configuration file (SPEC). If the application of version tags is detected, a new version tag value record is added to the version tag value database for the current package, with an initial value of 1.

[0012] Optionally, the step of automatically triggering recompilation by changing version tag values ​​when introducing new Golang packages, upgrading Golang package versions, and fixing CVE vulnerabilities in Golang software includes: when fixing CVE vulnerabilities in Golang software, the webhook project configured by the code repository increments the version tag values ​​of all Golang packages in the version tag value database. As the version tag values ​​of all Golang packages are incremented, the OBS compilation system is triggered to automatically scan the dependencies of all Golang packages in the version tag value database, rebuild the Golang packages, and archive and store them in the RPM package repository.

[0013] Optionally, the step of automatically triggering recompilation by the OBS build system through changes in version tag values ​​when introducing new Golang packages, upgrading Golang package versions, or fixing CVE vulnerabilities in Golang software includes: when upgrading packages developed using the Golang language or introducing new Golang packages, the OBS build system automatically scans the dependencies of Golang packages with reset or added version tag values ​​in the version tag value database, rebuilds the Golang packages, and archives and stores them in the RPM package repository due to the reset or addition of version tag values ​​of the Golang packages.

[0014] Furthermore, the present invention also provides a system for automatically patching CVE vulnerabilities in Golang packages, comprising a microprocessor and a memory interconnected thereto, wherein the microprocessor is programmed or configured to execute the method for automatically patching CVE vulnerabilities in the Golang packages.

[0015] Furthermore, the present invention also provides a computer-readable storage medium storing a computer program or instructions that are programmed or configured to execute, via a processor, a method for automatically patching CVE vulnerabilities using the Golang software package.

[0016] Furthermore, the present invention also provides a computer program product, including a computer program or instructions that are programmed or configured to execute, via a processor, a method for automatically patching CVE vulnerabilities using the Golang software package.

[0017] Compared with existing technologies, the present invention has the following main advantages: In Linux distributions using the RPM package manager and OBS compilation system, the present invention maintains and manages the version tag values ​​of Golang packages through a tag mechanism. When a new Golang package is introduced, a Golang package version is upgraded, or a CVE vulnerability is fixed in Golang software, the change in the version tag value causes the OBS compilation system to automatically trigger recompilation. The recompiled Golang package is then stored in the RPM package repository to achieve automatic repair of CVE vulnerabilities in Golang packages. This solves the problem of CVE vulnerabilities affecting the architecture adaptation code of Loongson and Shenwei, etc., that comes with Golang packages developed using the Golang language, as well as the problems of excessive complexity and manpower consumption in maintaining CVE vulnerabilities when there are a large number of Golang packages. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of the basic process of the method in an embodiment of the present invention.

[0019] Figure 2This is a schematic diagram illustrating the implementation principle of the method in an embodiment of the present invention. Detailed Implementation

[0020] During the development of Linux distributions, the first step is package selection. Packages developed in the Golang language, throughout the evolution of a specific distribution, consistently support compilation using the Golang version selected for that distribution. This invention introduces a labeling mechanism (golabel mechanism) to Linux distributions using RPM package managers. This mechanism includes the following functions: querying the version label value (golabel value) of a specified package; maintaining the version label value (golabel value) of the package; and providing a method to automatically obtain the architecture-adapted Golang sys and / or sys / unix sub-packages in the build system, replacing the CVE-affected Loongson and Shenwei architecture adaptation code included with the Golang package. The labeling mechanism (golabel mechanism) provides an automatic method for resolving CVE vulnerabilities in Golang packages adapted for architectures such as Loongson and Shenwei, enhancing the security of Golang packages interfacing with the OBS build system. Specifically... Figure 1 and Figure 2 As shown, the method for automatically patching CVE vulnerabilities in Golang packages in this embodiment includes the following steps: In Linux distributions using RPM package manager and OBS build system, version tag values ​​of Golang packages are maintained and managed through an introduced tag mechanism. When a new Golang package is introduced, the Golang package version is upgraded, or a CVE vulnerability in the Golang software is patched, the change in the version tag value causes the OBS build system to automatically trigger recompilation, and the recompiled Golang package is stored in the RPM package repository to achieve automatic patching of CVE vulnerabilities in the Golang package.

[0021] In this embodiment, the tagging mechanism introduced in Linux distributions using RPM package managers and OBS build systems includes a tag management macro package for building RPM packages (specifically named the golabel-rpm-macros package in this embodiment). This RPM package tag management macro package (golabel-rpm-macros package) includes the tag operation macro function _golabel, the sys subpackage replacement macro function _copy_golang_sys, the unix subpackage replacement macro function _copy_golang_unix, the sys_unix subpackage replacement macro function _copy_golang_sys_unix, and the storage path definition macro _golabel_db. The tag operation macro function _golabel is used by OBS to read the tag database and update Golang packages during compilation. The `Release` value on the `ang` package version number; the `sys` subpackage replacement macro function `_copy_golang_sys` is used by the configuration file of the Golang package's RPM package to replace the `sys` subpackage in the built-in architecture adaptation source code; the `unix` subpackage replacement macro function `_copy_golang_unix` is used by the configuration file of the Golang package's RPM package to replace the `unix` subpackage in the built-in architecture adaptation source code; the `sys_unix` subpackage replacement macro function `_copy_golang_sys_unix` is used by the configuration file of the Golang package's RPM package to replace the `sys` and `unix` subpackages in the built-in architecture adaptation source code; the storage path definition macro `_golabel_db` is used to define the file storage path for the version label value database; the label mechanism also includes: In the Golang package's configuration file SPEC, add a reference to the label manipulation macro function `_golabel` to retrieve the version label value of the Golang package from the version label value database. In this embodiment, the format of the reference to the label manipulation macro function `_golabel` is: `%define golabel %{expand:%_golabel %name}`; where `%` is a special character used to represent a macro parameter placeholder. `golabel` is the name of the macro, i.e., the user-defined macro identifier. `%{expand::` indicates the start of a macro expansion; `%{` is the start marker for macro expansion, and `expand` is the type of macro expansion used to expand the macro. `%_golabel`: This is a built-in macro; `%_` indicates that this is a built-in macro, and `golabel` is the name of the macro. This built-in macro may be used to generate a specific label or identifier. `%name`: This is another macro parameter placeholder; `%` indicates that this is a macro parameter, and `name` is the name of the parameter.

[0022] In the Golang package's configuration file SPEC, modify the value of the official release version number Release, appending the Golang package version tag value recorded in the version tag value database to the base feature version number Version of the Golang package. This avoids the need for subsequent updates to the version tag value in the Golang package's configuration file SPEC. For example, the expression in this embodiment is: , In the expression above, "1" represents the base version number (Version) of the Golang package, "%" is the concatenation operator, and the question mark indicates a condition: if the variable `dist` is defined, the expression expands to 1 plus the value of `dist`; if the variable `golabel` is also defined, then `golabel` is appended to the result of the previous step. Thus, the Golang package version label value recorded in the version label value database is appended to the base version number (Version) of the Golang package, avoiding the need for subsequent updates to the version label value in the Golang package's configuration file (SPEC).

[0023] During the preparatory phase of building the Golang package (%prep), the macro functions `_copy_golang_sys` (for the `sys` subpackage), `_copy_golang_unix` (for the `unix` subpackage), and `_copy_golang_sys_unix` (for the `sys_unix` subpackage) are called for partial or complete replacement of the `sys` and `unix` subpackages in the adaptation code for the target architecture. For example, in this embodiment, the appropriate macro functions from `_copy_golang_sys`, `_copy_golang_unix`, and `_copy_golang_sys_unix` are called for the Loongson and Shenwei architectures to replace the `vendor / golang.org / x / sys` and / or `vendor / golang.org / x / sys / unix` subpackages. The application of the tagging mechanism only requires a single modification. In this embodiment, the macro functions `_copy_golang_sys`, `_copy_golang_unix`, and `_copy_golang_sys_unix` for replacing the `sys` subpackage are all based on the file ` / usr / lib / rpm / macros.d / macros.goresource`. Their specific implementation includes: firstly, defining the resource file paths for the Golang language's `sys` and `unix` subpackages for compatible architectures such as Loongson and Shenwei; the `sys` subpackage replacement part in the macro functions `_copy_golang_sys` and `_copy_golang_sys_unix` includes: defining a macro function to obtain the Golang `sys` module code; if the `vendor / ` directory exists, then it searches for `golang.org / `. The `x / sys` subdirectory; if the `vendor / ` directory does not exist or the `golang.org / x / sys` subdirectory is not found, the function does not perform any valid modifications; the `sys_unix` subpackage replacement macro function and the `sys_unix` subpackage replacement part in the `_copy_golang_sys_unix` macro function include: defining a macro function to obtain the Unix module code of Golang, which searches for the `golang.org / x / sys / unix` subdirectory only if the `vendor / ` directory exists; if the `vendor / ` directory does not exist or the `golang.org / x / sys / unix` subdirectory is not found, the function does not perform any valid modifications, thus ultimately completing the replacement of the `vendor / golang.org / x / sys` and / or `vendor / golang.org / x / sys / unix` subpackages.

[0024] The version label value database can adopt the required storage method according to actual needs. For example, as an optional implementation, each record in the version label value database in this embodiment includes the package name of the Golang package and its corresponding version label value (golabel value), where the version label value is in pure numeric format and the value range is [1,∞). In addition, the version label value database in this embodiment is a text file, and each line contains two elements, namely "package name" and "golabel value", which are separated by a "half-width space", for example, the following two records: authz 3 skopeo 2 Two records are defined with package names "authz" and "skopeo", with corresponding version label values ​​(golabel values) of 3 and 2, respectively. Based on the above format definition, the label operation macro function _golabel in this embodiment is used to solve for the version label value (golabel value) of the Golang package. Its working process includes: Step 1: Expand the file path of the version label value database (golabel database); Step 2: Obtain the first parameter and escape any special characters within it. Step 3: Open the golabel database file for reading. If the file does not exist, exit; otherwise, proceed to step 4. Step 4: Iterate through each row of data in the golabel database. For the current row of data obtained through iteration, perform the following steps: First, check if the row meets the condition: it matches the input package name and is followed by one or more spaces and numbers. If the condition is met, it is used to extract the matching pattern of the second field and extract the second field from the matching row. If the second field is successfully extracted, print the result and add the ".go" prefix. At this time, immediately exit the matching process; otherwise, repeat the above steps until the target row is matched or all data has been traversed.

[0025] To facilitate the management of the version label value database, in this embodiment the version label value database is stored on the Git platform; after building the compilation environment, the OBS compilation system downloads the database file of the version label value database from the Git platform and stores it in the file path specified by the macro _golabel_db in the storage path definition.

[0026] In this embodiment, the version tag value of the Golang package is maintained and managed through an introduced tag mechanism, including: Version label value (golabel) increment: When a Golang package completes the CVE vulnerability patching for the sys or unix subpackage, the webhook project configured in the code repository increments the version label value of all Golang packages in the version label value database; Version label value (golabel) reset: When a package developed using the Golang language is upgraded, if the value of the basic feature version number Version of the Golang package or the value of the official release version number Release (which does not contain a version label) changes, the webhook project configured in the code repository will reset the version label value of the Golang package recorded in the version label value database and change it to 1. Version label value (golabel) addition: When a new Golang package developed in the Golang language is introduced, the webhook project configured by the code repository checks the configuration file SPEC of the Golang package. If the application of the version label value is found, a new version label value record is added to the version label value database for the current package, and the initial value of the version label value is 1.

[0027] like Figure 2As shown, after the CVE patching in Golang is completed, the OBS build system will automatically scan dependencies and rebuild. Because the `golabel` changes, all affected packages will be rebuilt, and upgraded packages will be archived in the RPM repository. Packages that have undergone version upgrades will also be rebuilt and archived in the RPM repository. This embodiment automatically triggers recompilation by the OBS build system when introducing new Golang packages, upgrading Golang packages, or patching CVE vulnerabilities in Golang software, by changing the version tag value. This includes: when patching CVE vulnerabilities in Golang software, the webhook project configured in the code repository increments the version tag value of all Golang packages in the version tag value database. This incrementing of the version tag value triggers the OBS build system to automatically scan dependencies for all Golang packages in the version tag value database, rebuild the Golang packages, and archive them in the RPM package repository. This embodiment automatically triggers recompilation by the OBS build system when introducing new Golang packages, upgrading Golang package versions, or fixing CVE vulnerabilities in Golang software, through changes in version tag values. This includes: when upgrading or introducing new Golang packages developed in the Golang language, the OBS build system automatically scans the dependencies of Golang packages with reset or added version tag values ​​in the version tag value database, rebuilds the Golang packages, and archives and stores them in the RPM package repository due to the reset or addition of version tag values ​​of the Golang packages.

[0028] In summary, when introducing Golang-developed software packages to Linux distributions using the RPM package manager and OBS build system, this embodiment checks the package's SPEC file. If it meets the requirements, the initial golabel value of the package is recorded in the golabel database. When a package undergoes a version upgrade, the golabel value of that package in the golabel database is reset. When Golang undergoes a version upgrade to fix CVEs in sys and / or unix subpackages, the golabel values ​​of all packages in the golabel database are incremented. The OBS build system triggers necessary recompilation due to the introduction of new packages, package version upgrades, and Golang version upgrades. The newly compiled packages already contain Golang architecture adaptation code after CVE repair and are stored in the RPM package repository due to version changes. At this time, packages affected by Golang software CVEs automatically complete CVE repair. This embodiment creates a `golabel-rpm-macros` package containing specific macro functions and a database path for automatically updating and replacing architecture adaptation source code in Golang packages, ensuring automatic CVE repair within the OBS build system. By building and maintaining the `golabel` database, this embodiment automatically tracks and manages package version and security updates, achieving an automated CVE repair process. The method introduces the definition and application of `golabel` values ​​in the RPM SPEC file, enabling dynamic updates and management of package version information, simplifying version control and security management complexity. Through the call of specific macro functions, this embodiment automatically replaces and updates architecture adaptation code in Golang packages, supporting Loongson and Shenwei architecture processors, ensuring multi-architecture compatibility and security. The automatic scanning and rebuilding functions of the OBS build system, combined with the labeling mechanism (`golabel`), achieve automated version updates and CVE repair for Golang packages, reducing manual operation and maintenance workload. The above innovations, combined with the introduction of the golabel mechanism, provide an efficient, secure, and automated method for managing Golang packages and fixing CVEs. This significantly improves the security and maintenance efficiency of packages, effectively solving the problems of CVE vulnerabilities affecting the Loongson and Shenwei architecture adaptation code attached to packages developed using the Golang language, as well as the excessive complexity and manpower required for maintaining CVE vulnerabilities when there are a large number of packages.

[0029] Furthermore, this embodiment also provides a system for automatically patching CVE vulnerabilities in Golang packages, including interconnected microprocessors and memory, wherein the microprocessors are programmed or configured to execute the method for automatically patching CVE vulnerabilities in Golang packages.

[0030] Furthermore, this embodiment also provides a computer-readable storage medium storing a computer program or instructions that are programmed or configured to execute, via a processor, a method for automatically patching CVE vulnerabilities using the Golang software package.

[0031] Furthermore, this embodiment also provides a computer program product, including a computer program or instructions that are programmed or configured to execute, via a processor, a method for automatically patching CVE vulnerabilities using the Golang software package.

[0032] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-readable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The functions specified in one or more boxes. These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable apparatus for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0033] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A method for automatically repairing CVE vulnerabilities in a Golang software package, characterized in that: The invention comprises the following steps: maintaining and managing the version label value of the Golang software package through the label mechanism introduced in the Linux distribution using the RPM package manager and the OBS compilation system, automatically triggering recompilation by the OBS compilation system through the change of the version label value when introducing a new Golang software package, upgrading the Golang software package version, and repairing the CVE vulnerability of the Golang software, and storing the recompiled Golang software package in the RPM software package repository to realize automatic repair of the CVE vulnerability of the Golang software package.

2. The method for automatically repairing CVE vulnerabilities using a Golang software package according to claim 1, characterized in that: The label mechanism introduced in the Linux distribution using the RPM package manager and the OBS compilation system includes building a label management macro software package of the RPM package, wherein the label management macro software package of the RPM package includes a label operation macro function _golabel, a sys subpackage replacement macro function _copy_golang_sys, a unix subpackage replacement macro function _copy_golang_unix, a sys_unix subpackage replacement macro function _copy_golang_sys_unix and a storage path definition macro _golabel_db, wherein the label operation macro function _golabel is used to read the label database when the OBS compiles the Golang software package to update the official release version number Release on the Golang software package version number The value of , the sys sub-package replacement macro function _copy_golang_sys is used to be called by the configuration file of the RPM package of the Golang software package to replace the sys sub-package in the built-in architecture adaptation source code, the unix sub-package replacement macro function _copy_golang_unix is ​​used to be called by the configuration file of the RPM package of the Golang software package to replace the unix sub-package in the built-in architecture adaptation source code, the sys_unix sub-package replacement macro function _copy_golang_sys_unix is ​​used to be called by the configuration file of the RPM package of the Golang software package to replace the sys sub-package and unix sub-package in the built-in architecture adaptation source code, the storage path definition macro _golabel_db is used to define the file storage path of the version label value database; The label mechanism also includes: in the configuration file SPEC of the Golang software package, adding a line of reference to the label operation macro function _golabel to obtain the version label value of the Golang software package from the version label value database; in the configuration file SPEC of the Golang software package, modifying the value of the official release version number Release of the software package, and appending the version label value of the Golang software package recorded in the version label value database to the value of the basic function version number Version of the Golang software package, so as to avoid the subsequent update of the version label value in the configuration file SPEC of the Golang software package; in the preparatory stage %prep of building the Golang software package, calling part or all of the sys sub-package replacement macro function _copy_golang_sys, the unix sub-package replacement macro function _copy_golang_unix, and the sys_unix sub-package replacement macro function _copy_golang_sys_unix for the target architecture to achieve the replacement of the sys sub-package and the unix sub-package in the adaptation code of the target architecture.

3. The method for automatically repairing CVE vulnerabilities using a Golang software package according to claim 2, characterized in that: Each record in the version tag value database includes the software package name of the Golang software package and its corresponding version tag value, wherein the version tag value is in a pure digital format and has a value range of [1,∞).

4. The method for automatically repairing CVE vulnerabilities using a Golang software package according to claim 3, characterized in that: The version label value database is stored on the git platform; after building the compilation environment, the OBS compilation system downloads the database file of the version label value database from the git platform and stores it in the file path specified by the storage path definition macro _golabel_db.

5. The method for automatically repairing CVE vulnerabilities using a Golang software package according to claim 4, characterized in that: The maintenance and management of the version tag value of the Golang software package through the introduced tag mechanism includes: version tag value increment: when the Golang software package completes the CVE vulnerability repair of the sys sub-package or the unix sub-package, the webhook project configured by the code warehouse increments the version tag values ​​of all Golang software packages in the version tag value database; version tag value reset: when the software package developed using the Golang language is upgraded, when the value of the basic function version number Version of the Golang software package or the value of the official release version number Release that does not contain a version tag value changes, the webhook project configured by the code warehouse resets the version tag value of the Golang software package recorded in the version tag value database and modifies it to 1; version tag value addition: when a new Golang software package developed in the Golang language is introduced, the webhook project configured by the code warehouse detects the configuration file SPEC of the Golang software package. If the application of the version tag value is found, a version tag value record is added for the current software package in the version tag value database, and the initial value of the version tag value is 1.

6. The method for automatically repairing CVE vulnerabilities using a Golang software package according to claim 1, characterized in that: The method of automatically triggering recompilation of the OBS compilation system through changes in version tag values ​​when introducing a new Golang software package, upgrading the Golang software package version, and fixing the CVE vulnerability of the Golang software includes: when the CVE vulnerability of the Golang software is fixed, the webhook project configured by the code warehouse increments the version tag values ​​of all Golang software packages in the version tag value database. Since the version tag values ​​of all Golang software packages are incremented, the OBS compilation system is triggered to automatically scan the dependencies of all Golang software packages in the version tag value database, rebuild the Golang software packages, and archive them in the RPM software package repository.

7. The method for automatically repairing CVE vulnerabilities using a Golang software package according to claim 1, characterized in that: The method of automatically triggering recompilation by the OBS compilation system through changes in version label values ​​when introducing a new Golang software package, upgrading the Golang software package version, and fixing the CVE vulnerability of the Golang software includes: when a software package developed in the Golang language is upgraded or a new Golang software package developed in the Golang language is introduced, the version label value of the Golang software package is reset or newly added, triggering the OBS compilation system to automatically scan the dependencies of the Golang software package with reset or newly added version label values ​​in the version label value database, rebuild the Golang software package, and archive it in the RPM software package repository.

8. A system for automatically repairing CVE vulnerabilities in a Golang software package, comprising a microprocessor and a memory connected to each other, characterized in that: The microprocessor is programmed or configured to execute the method for automatically repairing CVE vulnerabilities by a Golang software package as described in any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program or instruction stored therein, characterized in that: The computer program or instruction is programmed or configured to execute, through a processor, the method for automatically repairing CVE vulnerabilities in a Golang software package as described in any one of claims 1 to 7.

10. A computer program product comprising a computer program or instructions, characterized in that The computer program or instruction is programmed or configured to execute the method for automatically repairing CVE vulnerabilities by the Golang software package described in any one of claims 1 to 7 through a processor.

Images