Description

The product security team reviews all rpm scriptlets to spot security issues. Over the years we assigned a number of CVEs to issues, mostly allowing privilege escalation from service users to root. While we also try to train packagers it is something that will just happen, but the manual review is not the most fun job in the world. So we want to automate it

Goals

• Automate the review of the scriptlets in our rpm packages
• Evaluate if it is reliable enough to go into production. Either as a first line of defense or preferably to replace the manual review. That means false positives are annoying, false negatives are not acceptable (at least at a rate over the human rate)

Resources

I tried it with Gemini before, but Gemini isn't up for the task. Claude works much better, but is not available. Currently testing local LLMs on orthos machines