[v1] gitlab: update issue template for binary test cases

[RFC PATCH] gitlab: update issue template for binary test cases

Posted by Alex Bennée 2 weeks, 5 days ago

Binary test cases are sketchy because they can be vectors for phising
and other malware. Lets strongly hint that source bases tests are
preferred and binaries should have their provenance declared.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 .gitlab/issue_templates/bug.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.gitlab/issue_templates/bug.md b/.gitlab/issue_templates/bug.md
index 53a79f58284..cdb7ac1fe72 100644
--- a/.gitlab/issue_templates/bug.md
+++ b/.gitlab/issue_templates/bug.md
@@ -55,6 +55,10 @@ https://www.qemu.org/contribute/security-process/
 <!--
 Attach logs, stack traces, screenshots, etc. Compress the files if necessary.
 If using libvirt, libvirt logs and XML domain information may be relevant.
+
+If attaching binary test cases you should describe where they where obtained
+from preferably linking to the original source. We greatly prefer test cases in
+the form of source code that can be audited before compiling by the engineer.
 -->
 
 <!--
-- 
2.47.3

Re: [RFC PATCH] gitlab: update issue template for binary test cases

Posted by Peter Maydell 2 weeks, 5 days ago

On Mon, 11 May 2026 at 16:56, Alex Bennée <alex.bennee@linaro.org> wrote:
>
> Binary test cases are sketchy because they can be vectors for phising

"phishing"

> and other malware. Lets strongly hint that source bases tests are
> preferred and binaries should have their provenance declared.
>
> Suggested-by: Peter Maydell <peter.maydell@linaro.org>
> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
> ---
>  .gitlab/issue_templates/bug.md | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/.gitlab/issue_templates/bug.md b/.gitlab/issue_templates/bug.md
> index 53a79f58284..cdb7ac1fe72 100644
> --- a/.gitlab/issue_templates/bug.md
> +++ b/.gitlab/issue_templates/bug.md
> @@ -55,6 +55,10 @@ https://www.qemu.org/contribute/security-process/
>  <!--
>  Attach logs, stack traces, screenshots, etc. Compress the files if necessary.
>  If using libvirt, libvirt logs and XML domain information may be relevant.
> +
> +If attaching binary test cases you should describe where they where obtained

"were"

> +from preferably linking to the original source. We greatly prefer test cases in

"from, "

> +the form of source code that can be audited before compiling by the engineer.
>  -->

thanks
-- PMM