Method and system for automatically repairing CVE vulnerabilities in Golang software packages

Abstract

The present invention discloses a method and system for automatically repairing CVE vulnerabilities in a Golang software package. The method includes maintaining and managing the version label value of the Golang software package through an introduced label mechanism in a Linux distribution using the RPM package manager and the OBS compilation system. When a new Golang software package is introduced, the Golang software package version is upgraded, or a CVE vulnerability in the Golang software is repaired, the OBS compilation system automatically triggers the recompilation of the Golang software package and stores it in the RPM software package repository to achieve automatic repair of the CVE vulnerability. The present invention aims to solve the problem that the architecture adaptation code of the Loongson and Sunway architectures included with the Golang software package developed using the Golang language is affected by CVE vulnerabilities, as well as the problem that maintaining CVE vulnerabilities is too complex and labor-intensive when there are a large number of Golang software packages.

Description

Technical Field

[0001] The present invention relates to a management and repair mechanism for Common Vulnerabilities and Exposures (CVEs), and in particular to a method and system for automatically repairing CVEs using a Golang software package. Background Art

[0002] CVE (Common Vulnerabilities and Exposures) is a cybersecurity term used to describe and identify known vulnerabilities and security risks in the information security field. Due to its high performance and cross-platform nature, Golang has become a popular programming language in cloud computing, microservices, distributed systems, and other fields, and an increasing number of software packages are being developed using Golang.

[0003] Loongson and Shenwei architectures are processor architectures independently developed by China. With the development of domestic substitution, more and more cloud computing infrastructures have adopted Loongson (LoongArch64) and Shenwei (SW_64) processors.

[0004] In the community, most software packages developed using Golang only support processors based on the Aarch64 and X86_64 architectures. To adapt to processors based on the Loongson and Shenwei architectures, developers of Linux distributions generally add a compressed vendor.tar file to the source code to support building software packages on Linux operating systems based on the Loongson and Shenwei architectures. Due to the design differences between the Loongson and Shenwei architectures, a software package may provide an architecture-adapted vendor.tar package for each architecture to support both. The vendor.tar package contains a "vendor / golang.org / x" subdirectory, which contains various required subpackages. Generally speaking, the source code that affects architecture adaptation is mainly Golang's sys and sys / unix subpackages, where: golang.org / x / sys is a collection of Go packages containing various system calls and low-level operating system interfaces. These packages provide access to operating system functions, usually functions not covered in the standard library; golang.org / x / sys / unix is ​​a subpackage in the sys package that is specifically used to provide system calls and interfaces related to Unix systems.

[0005] Throughout the development of the Linux operating system, Common Vulnerabilities and Exposures (CVEs) have posed a serious threat to information security. As Golang evolves, it is also subject to potential impacts on system stability and security due to code robustness and other factors. For example, CVE-2022-29526 and CVE-2022-41721 affect Golang's sys / unix subpackages. To address these CVEs, every Golang package with architecture-adapted source code must be patched. The increasing number of packages significantly increases the complexity and manpower required for package maintenance, especially when packages provide architecture-adapted source code for both the Loongson and Sunway architectures. In the evolution of Linux distributions using the RPM (RPM Package Manager) package manager and the OBS (Open Build Service) build system, when CVEs are discovered in the Golang sys and / or unix modules, there is currently no automatic method to address these CVEs for Golang packages adapted for the Loongson and Sunway architectures. Summary of the Invention

[0006] Technical problem to be solved by the present invention: In response to the above-mentioned problems in the prior art, a method and system for automatically repairing CVE vulnerabilities in a Golang software package are provided. The present invention aims to solve the problem that the architecture adaptation codes of Loongson and Shenwei, etc., which are attached to the Golang software package developed using the Golang language, are affected by CVE vulnerabilities, as well as the problem that maintaining CVE vulnerabilities is too complex and manpower-consuming when there are a large number of Golang software packages.

[0007] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0008] A method for automatically repairing CVE vulnerabilities in a Golang software package comprises the following steps: maintaining and managing version label values ​​of a Golang software package through a label mechanism introduced in a Linux distribution using an RPM package manager and an OBS compilation system; automatically triggering recompilation of the OBS compilation system based on changes in the version label value when a new Golang software package is introduced, a Golang software package version is upgraded, or a CVE vulnerability in the Golang software is repaired; and storing the recompiled Golang software package in an RPM software package repository to automatically repair the CVE vulnerability in the Golang software package.

[0009] Optionally, the label mechanism introduced in the Linux distribution using the RPM package manager and the OBS compilation system includes building a label management macro software package of the RPM package, wherein the label management macro software package of the RPM package includes a label operation macro function _golabel, a sys subpackage replacement macro function _copy_golang_sys, a unix subpackage replacement macro function _copy_golang_unix, a sys_unix subpackage replacement macro function _copy_golang_sys_unix, and a storage path definition macro _golabel_db, wherein the label operation macro function _golabel is used for OBS to compile Golang. When the Golang package is installed, the tag database is read to update the official release version number Release value on the Golang package version number. The sys sub-package replacement macro function _copy_golang_sys is used to be called by the configuration file of the Golang package's RPM package to replace the sys sub-package in the source code of the built-in architecture adaptation. The unix sub-package replacement macro function _copy_golang_unix is ​​used to be called by the configuration file of the Golang package's RPM package to replace the unix sub-package in the source code of the built-in architecture adaptation. The sys_unix sub-package replacement macro function _copy_golang_sys_unix is ​​used by the Golang package's RPM package to replace the unix sub-package in the source code of the built-in architecture adaptation. The configuration file of the RPM package of the software package is called to replace the sys subpackage and the unix subpackage in the self-contained architecture adaptation source code, and the storage path definition macro _golabel_db is used to define the file storage path of the version label value database; the label mechanism also includes: in the configuration file SPEC of the Golang software package, adding a line of label operation macro function _golabel reference to obtain the version label value of the Golang software package from the version label value database; in the configuration file SPEC of the Golang software package, modifying the value of the official release version number Release of the software package, and replacing the Golang software package recorded in the version label value database The version tag value is appended to the value of the basic function version number Version of the Golang package to avoid the need to subsequently update the version tag value in the Golang package configuration file SPEC; in the preparatory stage %prep of building the Golang package, part or all of the sys sub-package replacement macro function _copy_golang_sys, the unix sub-package replacement macro function _copy_golang_unix, and the sys_unix sub-package replacement macro function _copy_golang_sys_unix are called for the target architecture to replace the sys sub-package and unix sub-package in the adaptation code of the target architecture.

[0010] Optionally, each record in the version tag value database includes the software package name of the Golang software package and its corresponding version tag value, wherein the version tag value is in a pure digital format and has a value range of [1,∞).

[0011] Optionally, the version label value database is stored on a git platform; after building the compilation environment, the OBS compilation system downloads the database file of the version label value database from the git platform and stores it in a file path specified by the storage path definition macro _golabel_db.

[0012] Optionally, the maintenance and management of the version tag value of the Golang software package through the introduced tag mechanism includes: version tag value increment: when the Golang software package completes the CVE vulnerability repair of the sys sub-package or the unix sub-package, the webhook project configured by the code warehouse increments the version tag values ​​of all Golang software packages in the version tag value database; version tag value reset: when the software package developed using the Golang language is upgraded, when the value of the basic function version number Version of the Golang software package or the value of the official release version number Release that does not contain a version tag value changes, the webhook project configured by the code warehouse resets the version tag value of the Golang software package recorded in the version tag value database and modifies it to 1; version tag value addition: when a new Golang software package developed in the Golang language is introduced, the webhook project configured by the code warehouse detects the configuration file SPEC of the Golang software package. If the application of the version tag value is found, a new version tag value record is added for the current software package in the version tag value database, and the initial value of the version tag value is 1.

[0013] Optionally, the method of automatically triggering recompilation of the OBS compilation system through changes in version tag values ​​when introducing a new Golang software package, upgrading the Golang software package version, and fixing the CVE vulnerability of the Golang software includes: when the CVE vulnerability of the Golang software is fixed, the webhook project configured by the code repository increments the version tag values ​​of all Golang software packages in the version tag value database. Since the version tag values ​​of all Golang software packages are incremented, the OBS compilation system is triggered to automatically scan the dependencies of all Golang software packages in the version tag value database, rebuild the Golang software packages, and archive them in the RPM software package repository.

[0014] Optionally, the OBS compilation system is automatically triggered to recompile through changes in version tag values ​​when a new Golang software package is introduced, a Golang software package version is upgraded, or a CVE vulnerability of the Golang software is fixed, including: when a software package developed using the Golang language is upgraded or a new Golang software package developed in the Golang language is introduced, the version tag value of the Golang software package is reset or newly added, triggering the OBS compilation system to automatically scan the dependencies of the Golang software package with the reset or newly added version tag value in the version tag value database, rebuild the Golang software package, and archive it in the RPM software package repository.

[0015] In addition, the present invention also provides a system for automatically repairing CVE vulnerabilities using a Golang software package, comprising a microprocessor and a memory connected to each other, wherein the microprocessor is programmed or configured to execute the method for automatically repairing CVE vulnerabilities using the Golang software package.

[0016] In addition, the present invention also provides a computer-readable storage medium, which stores a computer program or instruction. The computer program or instruction is programmed or configured to execute the method of automatically repairing CVE vulnerabilities in the Golang software package through a processor.

[0017] In addition, the present invention also provides a computer program product, including a computer program or instructions, which are programmed or configured to execute the method of automatically repairing CVE vulnerabilities in the Golang software package through a processor.

[0018] Compared with the prior art, the present invention mainly has the following advantages: the present invention maintains and manages the version label value of the Golang software package through the label mechanism introduced in the Linux distribution using the RPM package manager and the OBS compilation system, and automatically triggers recompilation of the OBS compilation system through the change of the version label value when a new Golang software package is introduced, the Golang software package version is upgraded, and the CVE vulnerability of the Golang software is repaired, and the recompiled Golang software package is stored in the RPM software package repository to automatically repair the CVE vulnerability of the Golang software package, thereby solving the problem that the architecture adaptation code of Loongson and Shenwei, etc. attached to the Golang software package developed in the Golang language is affected by the CVE vulnerability, and the problem that the maintenance of CVE vulnerabilities is too complex and labor-intensive when the number of Golang software packages is large. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 Schematic diagram of the basic process of the method of the embodiment of the present invention.

[0020] Figure 2Schematic diagram of the implementation principle of the method of the embodiment of the present invention. DETAILED DESCRIPTION

[0021] During the development process of Linux distribution, software packages will be selected first. During the evolution of a specific distribution, software packages developed with the Golang language always support compilation using the Golang selected for the distribution. The method of the present invention for automatically repairing CVE vulnerabilities in Golang software packages introduces a label mechanism (golabel mechanism) for Linux distributions using the RPM package manager, including the following functions: querying the version label value (golabel value) of a specified software package; maintaining the version label value (golabel value) of the software package; providing a method that can automatically obtain the Golang sys and (or) sys / unix sub-packages that have completed architecture adaptation in the build system, and replace the Loongson and Shenwei architecture adaptation code that is affected by CVE and is included in the software package developed with the Golang language. The label mechanism (golabel mechanism) provides a method for automatically resolving CVE vulnerabilities for Golang software packages that have adapted to architectures such as Loongson and Shenwei, and provides the security of Golang software packages docking with the OBS compilation system. Specifically, Figure 1 and Figure 2 As shown, the method for automatically repairing CVE vulnerabilities in a Golang software package in this embodiment includes the following steps: maintaining and managing the version label value of the Golang software package through the introduced label mechanism in a Linux distribution using the RPM package manager and the OBS compilation system, automatically triggering recompilation of the OBS compilation system through changes in the version label value when a new Golang software package is introduced, the Golang software package version is upgraded, and the CVE vulnerability of the Golang software is repaired, and the recompiled Golang software package is stored in the RPM software package repository to automatically repair the CVE vulnerability of the Golang software package.

[0022] In this embodiment, the label mechanism introduced in the Linux distribution using the RPM package manager and the OBS compilation system includes building a label management macro software package for the RPM package (specifically named the golabel-rpm-macros software package in this embodiment). The label management macro software package for the RPM package (the golabel-rpm-macros software package) includes a label operation macro function _golabel, a sys subpackage replacement macro function _copy_golang_sys, a unix subpackage replacement macro function _copy_golang_unix, a sys_unix subpackage replacement macro function _copy_golang_sys_unix, and a storage path definition macro _golabel_db. The label operation macro function _golabel is used to read the label database and update Golang when OBS compiles the Golang software package. The value of the official release version number Release on the ang software package version number, the sys sub-package replacement macro function _copy_golang_sys is used to be called by the configuration file of the RPM package of the Golang software package to replace the sys sub-package in the built-in architecture adaptation source code, the unix sub-package replacement macro function _copy_golang_unix is ​​used to be called by the configuration file of the RPM package of the Golang software package to replace the unix sub-package in the built-in architecture adaptation source code, the sys_unix sub-package replacement macro function _copy_golang_sys_unix is ​​used to be called by the configuration file of the RPM package of the Golang software package to replace the sys sub-package and unix sub-package in the built-in architecture adaptation source code, the storage path definition macro _golabel_db is used to define the file storage path of the version label value database; the label mechanism also includes:

[0023] In the configuration file SPEC of the Golang software package, add a line of reference to the label operation macro function _golabel to obtain the version label value of the Golang software package from the version label value database. In this embodiment, the format of the reference to the label operation macro function _golabel is: %define golabel %{expand:%_golabel %name}; where % is a special character used to represent the placeholder for macro parameters. golabel is the name of the macro, that is, a user-defined macro identifier. %{expand:: This indicates the start of a macro expansion, %{ is the start mark of the macro expansion, and expand is the type of macro expansion, which is used to expand the macro. %_golabel: This is a built-in macro, %_ indicates that this is a built-in macro, and golabel is the name of the macro. This built-in macro may be used to generate a specific label or identifier. %name: This is another macro parameter placeholder, % indicates that this is a macro parameter, and name is the name of the parameter.

[0024] In the configuration file SPEC of the Golang software package, the value of the official release version number Release of the software package is modified, and the version tag value of the Golang software package recorded in the version tag value database is appended to the value of the basic function version number Version of the Golang software package, so as to avoid the subsequent operation of updating the version tag value in the configuration file SPEC of the Golang software package; for example, the expression in this embodiment is:

[0025] ,

[0026] In the above expression, "1" represents the value of the Golang package's basic functionality version number, "%" is a hyphen, and the question mark indicates a checksum. That is, if the variable dist is defined, the expression expands to 1 plus its value; if the variable golabel is also defined, golabel is appended to the result of the previous step. This appends the Golang package's version label value, as recorded in the version label value database, to the Golang package's basic functionality version number, Version, eliminating the need to subsequently update the version label value in the Golang package's configuration file, SPEC.

[0027] During the %prep phase of building a Golang package, the macro functions _copy_golang_sys, _copy_golang_unix, and _copy_golang_sys_unix are called for the target architecture to replace the sys and unix subpackages in the adaptation code. For example, in this embodiment, the macro functions _copy_golang_sys, _copy_golang_unix, and _copy_golang_sys_unix are called for the Loongson and Shenwei architectures, replacing the vendor / golang.org / x / sys and / or vendor / golang.org / x / sys / unix subpackages. The tag mechanism only requires a single modification. In this embodiment, the sys sub-package replacement macro function _copy_golang_sys, the unix sub-package replacement macro function _copy_golang_unix, and the sys_unix sub-package replacement macro function _copy_golang_sys_unix are all based on the file / usr / lib / rpm / macros.d / macros.goresource. Its specific implementation includes: first, defining the resource file paths of the sys sub-package and unix sub-package of the Golang language for adaptation architectures such as Loongson and Shenwei respectively; the sys sub-package replacement macro function _copy_golang_sys and the sys_unix sub-package replacement macro function _copy_golang_sys_unix in the sys sub-package replacement part include: defining a macro function for obtaining the sys module code of golang, and searching golang.org / if the vendor / directory exists. x / sys subdirectory; if the vendor / directory does not exist or the golang.org / x / sys subdirectory is not found, the function does not perform any effective modification; the sys_unix subpackage replacement macro function and the sys_unix subpackage replacement part in the sys_unix subpackage replacement macro function _copy_golang_sys_unix include: defining a macro function for obtaining golang's unix module code, and searching for the golang.org / x / sys / unix subdirectory only if the vendor / directory exists; if the vendor / directory does not exist or the golang.org / x / sys / unix subdirectory is not found, the function does not perform any effective modification, thereby finally completing the replacement of vendor / golang.org / x / sys and (or) vendor / golang.org / x / sys / unix subpackages.

[0028] The version label value database can be stored in a desired manner based on actual needs. For example, as an optional implementation, each record in this embodiment includes the package name of the Golang software package and its corresponding version label value (golabel value), where the version label value is in pure numeric format and has a value range of [1, ∞). Furthermore, in this embodiment, the version label value database is a text file, with each line containing two elements: "package name" and "golabel value." The two attributes are separated by a "half-width space." For example, the following two records:

[0029] authz 3

[0030] skopeo 2

[0031] Two records are defined for the software packages "authz" and "skopeo", with corresponding version label values ​​(golabel values) of 3 and 2, respectively. Based on the above format definition, the label operation macro function _golabel in this embodiment is used to solve the version label value (golabel value) of the Golang software package. Its working process includes:

[0032] Step 1. Expand the file path of the version label value database (golabel database);

[0033] Step 2: Get the first parameter and escape the special characters in it

[0034] Step 3: Open the golabel database file for reading. If the file does not exist, exit; otherwise, jump to step 4.

[0035] Step 4: Traverse each row of data in the golabel database. For the current row of data obtained through traversal, perform the following steps: First, check whether the row meets the conditions: matching the passed package name and followed by one or more spaces and numbers. If the conditions are met, use it to extract the matching pattern of the second field and extract the second field in the matching row. If the second field is successfully extracted, print the result and add the ".go" prefix, then immediately exit the matching process; otherwise, repeat the above steps until the target row is matched or all data is traversed.

[0036] To facilitate the management of the version label value database, in this embodiment, the version label value database is stored on the git platform; after building the compilation environment, the OBS compilation system downloads the database file of the version label value database from the git platform and stores it in the file path specified by the storage path definition macro _golabel_db.

[0037] In this embodiment, the tag mechanism introduced to maintain and manage the version tag values ​​of the Golang software package includes:

[0038] Version label value (golabel) increment: When a Golang package completes a CVE vulnerability fix for the sys or unix subpackage, the webhook project configured in the code repository increments the version label values ​​of all Golang packages in the version label value database.

[0039] Version label value (golabel) reset: When a Golang package is upgraded, if the value of the basic function version number (Version) or the official release version number (Release) without a version label value changes, the webhook project configured in the code repository resets the version label value of the Golang package recorded in the version label value database to 1.

[0040] New version label value (golabel): When a new Golang package developed in the Golang language is introduced, the webhook project configured in the code repository checks the Golang package's configuration file SPEC. If the version label value is found, a new version label value record is added to the version label value database for the current package, and the initial value of the version label value is 1.

[0041] like Figure 2As shown, after Golang fixes the CVE, it will trigger the OBS compilation system to automatically scan dependencies and rebuild. Due to the change in golabel, all affected software packages will be rebuilt, and the upgraded software packages will be archived to the RPM warehouse. If the software package itself is upgraded, the new version software package will also be rebuilt due to the version upgrade, and the new version software package will be archived to the RPM warehouse. This embodiment automatically triggers recompilation of the OBS compilation system through changes in version label values ​​when introducing new Golang software packages, upgrading Golang software package versions, and fixing CVE vulnerabilities of Golang software. The following includes: when the CVE vulnerability of Golang software is fixed, the webhook project configured by the code warehouse increments the version label values ​​of all Golang software packages in the version label value database. Since the version label values ​​of all Golang software packages are incremented, the OBS compilation system is triggered to automatically scan dependencies for all Golang software packages in the version label value database, rebuild the Golang software packages, and archive them to the RPM software package warehouse. This embodiment automatically triggers recompilation of the OBS compilation system through changes in version tag values ​​when introducing a new Golang software package, upgrading the Golang software package version, or fixing the CVE vulnerability of the Golang software. The following includes: when a software package developed in the Golang language is upgraded or a new Golang software package developed in the Golang language is introduced, the version tag value of the Golang software package is reset or newly added, triggering the OBS compilation system to automatically scan the dependencies of the Golang software package with the reset or newly added version tag value in the version tag value database, rebuild the Golang software package, and archive it in the RPM software package repository.

[0042] In summary, when the method of this embodiment introduces a software package developed in the Golang language into a Linux distribution that uses the RPM package manager and the OBS compilation system, the SPEC file of the software package is checked. If the conditions are met, the initial golabel value of the software package is recorded in the golabel database; when the software package is upgraded, the golabel value of the software package in the golabel database is reset; when the Golang version is upgraded due to the repair of CVEs of sys and (or) unix subpackages, the golabel values ​​of all software packages in the golabel database will be triggered to increase; the OBS compilation system will trigger necessary recompilation due to the introduction of new software packages, software package version upgrades, and Golang version upgrades. The newly compiled software package already contains the Golang architecture adaptation code after the CVE is fixed, and due to the version change, it will be stored in the RPM software package repository; at this time, the software package affected by the CVE of the Golang software automatically completes the CVE repair. In the method of this embodiment, a golabel-rpm-macros software package is created, which contains specific macro functions and database paths for automatically updating and replacing the architecture adaptation source code in the Golang software package, ensuring automatic CVE repair in the OBS compilation system; in the method of this embodiment, by building and maintaining the golabel database, the version and security updates of the software package are automatically tracked and managed, thereby realizing an automated CVE repair process; in the method of this embodiment, the definition and application of the golabel value are introduced in the RPM SPEC file, so that the version information of the software package can be dynamically updated and managed, simplifying the complexity of version control and security management; in the method of this embodiment, by calling specific macro functions, the architecture adaptation code in the Golang software package is automatically replaced and updated, supporting Loongson and Shenwei architecture processors, and ensuring the compatibility and security of multiple architectures; in the method of this embodiment, the automatic scanning and reconstruction function of the OBS compilation system, combined with the label mechanism (golabel mechanism), realizes the automatic version update and CVE repair of the Golang software package, reducing the workload of manual operation and maintenance. These innovations, combined with the introduction of the golabel mechanism, provide an efficient, secure, and automated Golang package management and CVE remediation method, significantly improving the security and maintenance efficiency of software packages. This effectively addresses the issues of the Loongson and Sunway architecture adaptation codes included in software packages developed using the Golang language being affected by CVE vulnerabilities, as well as the high complexity and manpower required to maintain CVE vulnerabilities when there are a large number of software packages.

[0043] In addition, this embodiment also provides a system for automatically repairing CVE vulnerabilities with a Golang software package, including a microprocessor and a memory connected to each other, wherein the microprocessor is programmed or configured to execute the method for automatically repairing CVE vulnerabilities with a Golang software package.

[0044] In addition, this embodiment also provides a computer-readable storage medium, which stores a computer program or instruction. The computer program or instruction is programmed or configured to execute the method of automatically repairing CVE vulnerabilities in the Golang software package through a processor.

[0045] In addition, this embodiment also provides a computer program product, including a computer program or instructions, which are programmed or configured to execute the method of automatically repairing CVE vulnerabilities in the Golang software package through a processor.

[0046] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application may take the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of processes and / or boxes in the flowchart and / or block diagram, may be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the functions described in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including the instruction device, which implements the function specified in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0047] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiment. All technical solutions based on the concept of the present invention are within the scope of protection of the present invention. It should be noted that for those skilled in the art, various improvements and modifications that do not depart from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A method for automatically repairing CVE vulnerabilities in a Golang software package, characterized in that: The method includes the following steps: maintaining and managing the version tag value of a Golang software package through a tag mechanism introduced in a Linux distribution using an RPM package manager and an OBS compilation system; automatically triggering recompilation of the OBS compilation system through changes in the version tag value when a new Golang software package is introduced, a Golang software package version is upgraded, or a Common Vulnerability Encoding (CVE) vulnerability of the Golang software is fixed; and storing the recompiled Golang software package in an RPM software package repository to automatically fix the CVE vulnerability of the Golang software package. The label mechanism includes building a label management macro software package for the RPM package. The label management macro software package for the RPM package includes a label operation macro function _golabel, a sys subpackage replacement macro function _copy_golang_sys, a unix subpackage replacement macro function _copy_golang_unix, a sys_unix subpackage replacement macro function _copy_golang_sys_unix, and a storage path definition macro _golabel_db. The label operation macro function _golabel is used to read the label database and update the official release version number Release on the Golang package version number when OBS compiles the Golang package. The sys subpackage replacement macro function _copy_golang_sys is used to replace the Golang subpackage replacement macro function _copy_golang_unix. opy_golang_sys is used to be called by the configuration file of the RPM package of the Golang software package to replace the sys sub-package in the built-in architecture adaptation source code, the unix sub-package replacement macro function _copy_golang_unix is ​​used to be called by the configuration file of the RPM package of the Golang software package to replace the unix sub-package in the built-in architecture adaptation source code, the sys_unix sub-package replacement macro function _copy_golang_sys_unix is ​​used to be called by the configuration file of the RPM package of the Golang software package to replace the sys sub-package and unix sub-package in the built-in architecture adaptation source code, the storage path definition macro _golabel_db is used to define the file storage path of the version label value database; The label mechanism also includes: version label value increment: when the Golang software package completes the CVE vulnerability repair of the sys sub-package or the unix sub-package, the webhook project configured by the code warehouse increments the version label values ​​of all Golang software packages in the version label value database; version label value reset: when the software package developed using the Golang language is upgraded, when the value of the basic function version number Version of the Golang software package or the value of the official release version number Release that does not contain a version label value changes, the webhook project configured by the code warehouse resets the version label value of the Golang software package recorded in the version label value database and modifies it to 1; version label value addition: when a new Golang software package developed in the Golang language is introduced, the webhook project configured by the code warehouse detects the configuration file SPEC of the Golang software package. If the application of the version label value is found, a version label value record is added for the current software package in the version label value database, and the initial value of the version label value is 1.

2. The method for automatically repairing CVE vulnerabilities using a Golang software package according to claim 1, wherein: The label mechanism also includes: adding a line of reference to the label operation macro function _golabel in the configuration file SPEC of the Golang software package to obtain the version label value of the Golang software package from the version label value database; modifying the value of the official release version number Release of the software package in the configuration file SPEC of the Golang software package, and appending the version label value of the Golang software package recorded in the version label value database to the value of the basic function version number Version of the Golang software package, so as to avoid the subsequent update of the version label value in the configuration file SPEC of the Golang software package; in the preparatory stage %prep of building the Golang software package, calling part or all of the sys sub-package replacement macro function _copy_golang_sys, the unix sub-package replacement macro function _copy_golang_unix, and the sys_unix sub-package replacement macro function _copy_golang_sys_unix for the target architecture to replace the sys sub-package and the unix sub-package in the adaptation code of the target architecture.

3. The method for automatically repairing CVE vulnerabilities using a Golang software package according to claim 2, wherein: Each record in the version tag value database includes the software package name of the Golang software package and its corresponding version tag value, wherein the version tag value is in a pure digital format and has a value range of [1,∞).

4. The method for automatically repairing CVE vulnerabilities using a Golang software package according to claim 3, wherein: The version label value database is stored on the git platform; after building the compilation environment, the OBS compilation system downloads the database file of the version label value database from the git platform and stores it in the file path specified by the storage path definition macro _golabel_db.

5. The method for automatically repairing CVE vulnerabilities using a Golang software package according to claim 1, wherein: The method of automatically triggering recompilation of the OBS compilation system through changes in version tag values ​​when introducing new Golang software packages, upgrading Golang software package versions, and fixing CVE vulnerabilities in Golang software includes: when the CVE vulnerability of Golang software is fixed, the webhook project configured by the code warehouse increments the version tag values ​​of all Golang software packages in the version tag value database. Since the version tag values ​​of all Golang software packages are incremented, the OBS compilation system is triggered to automatically scan the dependencies of all Golang software packages in the version tag value database, rebuild the Golang software packages, and archive them in the RPM software package repository.

6. The method for automatically repairing CVE vulnerabilities using a Golang software package according to claim 1, wherein: The method of automatically triggering recompilation by the OBS compilation system through changes in version tag values ​​when introducing a new Golang software package, upgrading the Golang software package version, or fixing the CVE vulnerability of the Golang software includes: when a software package developed in the Golang language is upgraded or a new Golang software package developed in the Golang language is introduced, the version tag value of the Golang software package is reset or newly added, triggering the OBS compilation system to automatically scan the dependencies of the Golang software package with reset or newly added version tag values ​​in the version tag value database, rebuild the Golang software package, and archive it in the RPM software package repository.

7. A system for automatically repairing CVE vulnerabilities in a Golang software package, comprising a microprocessor and a memory connected to each other, characterized in that: The microprocessor is programmed or configured to execute the method for automatically repairing CVE vulnerabilities of a Golang software package as described in any one of claims 1 to 6.

8. A computer-readable storage medium having a computer program or instruction stored therein, characterized in that: The computer program or instruction is programmed or configured to execute, through a processor, the method for automatically repairing CVE vulnerabilities in a Golang software package as recited in any one of claims 1 to 6.

9. A computer program product comprising a computer program or instructions, characterized in that The computer program or instruction is programmed or configured to execute, through a processor, the method for automatically repairing CVE vulnerabilities in a Golang software package as recited in any one of claims 1 to 6.

Images