From 45fa5603a7c1bb92f7a96c29888f0a444f4ba495 Mon Sep 17 00:00:00 2001
From: Fabio Erculiani <lxnay@sabayon.org>
Date: Sat, 2 Jan 2010 19:46:58 +0100
Subject: [PATCH] [docs] add Entropy security advisories metadata
 specifications (inherited from Gentoo)

---
 docs/glsa.dtd | 327 ++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 327 insertions(+)
 create mode 100644 docs/glsa.dtd

diff --git a/docs/glsa.dtd b/docs/glsa.dtd
new file mode 100644
index 000000000..272d24f0e
--- /dev/null
+++ b/docs/glsa.dtd
@@ -0,0 +1,327 @@
+<!-- $Header: /var/cvsroot/gentoo/xml/htdocs/dtd/glsa.dtd,v 1.17 2008/04/04 17:04:39 neysx Exp $ -->
+<!ELEMENT glsa  (title,synopsis,product,announced,revised,bug*,access?,affected,background?,description,impact,workaround,resolution,references,license?,metadata*)>
+<!ATTLIST glsa  id  CDATA   #REQUIRED>
+
+<!-- 
+    Element:      title
+    Description:  Provides a 4-5 word description about the advisory 
+    Example:      <title>Buffer overflow vulnerability found in openssl-0.9.5</title> 
+-->
+<!ELEMENT title  (#PCDATA)>
+
+<!-- 
+    Element:      synopsis
+    Description:  Small, to-the-point description about the GLSA
+
+    Example:  <synopsis>
+                  rsync has an exploitable buffer overflow that can lead to
+                  remote compromise
+              </synopsis>
+-->
+<!ELEMENT synopsis   (#PCDATA)>
+
+<!-- 
+    Element:      product
+    Description:  Defines what type of security announcement this is.
+    
+                  Valid types are:
+                  - ebuild         A Portage-provided ebuild has a security 
+                                   issue
+                  - informational  This GLSA is purely informational, no Gentoo
+                                   system is affected
+                  - infrastructure The security issue involves the Gentoo 
+                                   infrastructure
+    
+                  The text contains one keyword that defines the issue.
+     
+    Example: <product type="ebuild">openssl</product>
+    Example: <product type="infrastructure">rsync mirror</product>
+-->
+<!ELEMENT product   (#PCDATA)>
+<!ATTLIST product   type    (ebuild|infrastructure|informational) #REQUIRED>
+
+<!--
+    Element:      announced
+    Description:  Date when the advisory is publicised
+                  The format must be "YYYY-mm-dd"
+
+    Example: <announced>2003-11-20</announced>
+-->
+<!ELEMENT announced (#PCDATA)>
+
+<!--
+    Element:      revised
+    Description:  Last revision date of the GLSA
+    Attribute:    @count: number of revisions
+    
+    Example: <revised count="02">2003-11-20</revised>
+-->
+<!ELEMENT revised (#PCDATA)>
+<!ATTLIST revised count CDATA "01">
+
+<!--
+    Element:      bug
+    Description:  Number of the bug on bugs.gentoo.org, if any
+    Occurrence:    The bug element can occur 0, 1 or more times
+
+    Example: <bug>34200</bug>
+-->
+<!ELEMENT bug       (#PCDATA)>
+
+<!--
+    Element:      access
+    Description:  Type of access necessary to exploit the security issue
+                  This element should only be used when product@type = 'ebuild'
+    Occurrence:    The access element can occur 0 or 1 time
+    
+    Example: <access>Remote</access>
+-->
+<!ELEMENT access    (#PCDATA)>
+
+<!--
+    Element:      affected
+    Description:  Describe what the affected subjects are.
+    
+                  If product@type = 'build', the child elements are 'package'
+                  If product@type = 'portage', the child elements are 'package'
+                  If product@type = 'infrastructure', the child elements are 
+                  'service'
+
+-->
+<!ELEMENT affected  (package*|service*)>
+
+<!--
+    Element:      package
+    Description:  Provide all necessary information regarded the affected 
+                  packages. It also contains information about the affected 
+                  architectures, if automatic updates can be done and the update
+
+                  The "update" attribute contains the path to the non-vulnerable
+                  version of the package
+
+                  The "auto" attribute contains either "yes" or "no" and tells 
+                  Portage that the package can be updated automatically (to be 
+                  implemented) without further user interaction
+
+                  The "arch" attribute contains either the architecture (as used
+                  by ACCEPT_KEYWORDS) or the "*" value (in case all 
+                  architectures are affected)
+
+    Occurrence:   The package element can occur 0, 1 or more times
+    Example:      <package name="dev-libs/openssl" auto="yes" arch="*">
+                    <vulnerable range="lt">0.9.6k</vulnerable>
+                    <unaffected range="gt">0.9.6k</unaffected>
+                  </package>
+-->
+<!ELEMENT package (vulnerable|unaffected)*>
+<!ATTLIST package name      CDATA           #REQUIRED
+                  auto      (yes|no)    #REQUIRED
+                  arch      CDATA           #REQUIRED>
+
+<!--
+    Element:      vulnerable
+    Description:  Version of the vulnerable package. Can be a range too
+-->
+<!ELEMENT vulnerable (#PCDATA)>
+<!ATTLIST vulnerable range      (le|lt|eq|gt|ge|rlt|rle|rgt|rge)      #REQUIRED>
+
+<!--
+    Element:      unaffected
+    Description:  Version of the fixed (or unaffected) package. In case the 
+                  package is superseded by another package, you need to
+                  define that package using the "name" attribute.
+
+                  The r* range information is revision-specific. For instance, 
+                  rge foo-1.2.3-r4  ==  >=foo-1.2.3-r4 && <foo-1.2.4
+
+    Example:
+                  <unaffected range="gt" name="foobar">2.0.0</unaffected>
+-->
+<!ELEMENT unaffected (#PCDATA)>
+<!ATTLIST unaffected range      (le|lt|eq|gt|ge|rlt|rle|rgt|rge)      #REQUIRED
+                     name       CDATA                 #IMPLIED>
+
+<!--
+    Element:      service
+    Description:  Provide information about the Gentoo services that are
+                  affected by the security advisory. Portage must be able
+                  to parse this information to make decisions (for instance, 
+                  ignore an rsync server or a certain distfiles mirror).
+
+                  The type attribute can be one of "rsync", "web", "mirror".
+
+                  The fixed attribute (denoting if the problem has been solved)
+                  can be one of "yes" or "no". If not used, the default value is
+                  "no".
+                  
+    Occurrence:   The service element can occur 0, 1 or more times
+    Example: <service type="rsync">rsync://rsync.someserver.tld/gentoo-portage</service>
+-->
+<!ELEMENT service (#PCDATA)>
+<!ATTLIST service type (rsync|web|mirror) #REQUIRED
+                  fixed (yes|no)          #IMPLIED>
+
+<!--
+    Element:      uri
+    Description:  Link to the organisation involved in releasing the advisory
+    Occurrence:   The uri element can occur 0, 1 or more times
+
+    Example:      <uri link="http://www.cert.org">CERT</uri>
+-->
+<!ELEMENT uri       (#PCDATA)>
+<!ATTLIST uri     link  CDATA   #IMPLIED>
+
+<!--
+    Element:      mail
+    Description:  Mail address of the people involved in releasing the advisory
+    Occurrence:   The mail element can occur 0, 1 or more times
+
+    Example:      <mail link="some@person.com">Some Person</mail>
+-->
+<!ELEMENT mail      (#PCDATA)>
+<!ATTLIST mail    link  CDATA   #REQUIRED>
+
+<!--
+    Element:      p
+    Description:  Plain text
+    Occurrence:   The "p" element can occur 0, 1 or more times and can contain
+                  links or addresses
+
+    Example:      <p>Please update your system</p>
+-->
+<!ELEMENT p (#PCDATA|mail|uri|b|i|br)*>
+
+<!--
+    Element:      code
+    Description:  The code element contains text that should preserve whitespace
+                  and is therefore useful for code listings or commands
+
+    Example:      <code>emerge sync</code>
+-->
+<!ELEMENT code (#PCDATA)>
+
+<!--
+    Element:      background
+    Description:  Provides a background of the affected package(s)/service(s)
+                  The background element contains only "<p>"s in which the text 
+                  is placed
+
+-->
+<!ELEMENT background  (p|ul|ol)*>
+
+<!--
+    Element:      description
+    Description:  Provides a description about the security issue
+                  The description element contains only "<p>"s.
+-->
+<!ELEMENT description (p|ul|ol|code)*>
+
+<!--
+    Element:      impact
+    Description:  Provides information about the impact that the security issue 
+                  can have
+
+                  The "impact" element contains only "<p>"s.
+
+                  The type element gives a short term, such as 
+                  "Denial of Service", "Buffer Overflow", ...
+
+-->
+<!ELEMENT impact    (p|ul|ol)*>
+<!ATTLIST impact    type    CDATA   #REQUIRED>
+
+<!--
+    Element:      workaround
+    Description:  Provides information about how the security issue can be 
+                  (temporarily) resolved through a work-around
+
+                  The "workaround" element contains only "<p>"s and "<code>"s.
+-->
+<!ELEMENT workaround    (p|code|ul|ol)*>
+
+<!--
+    Element:      resolution
+    Description:  Provides information about how the security issue can be 
+                  resolved.
+
+                  The "resolution" element contains only "<p>"s and "<code>"s.
+-->
+<!ELEMENT resolution  (p|code|ul|ol)*>
+
+<!--
+    Element:      references
+    Description:  Provides links to resources / references available online.
+                  
+                  The "reference" element contains only "<uri>"s.
+-->
+<!ELEMENT references    (uri*)>
+
+<!--
+    Element:      ul
+    Description:  Add an unnumbered listing; can only contain <li>'s
+-->
+<!ELEMENT ul            (li*)>
+
+<!--
+    Element:      ol
+    Description:  Add a numbered listing; can only contain <li>'s
+-->
+<!ELEMENT ol            (li*)>
+
+<!--
+    Element:      li
+    Description:  Element of a listing 
+ 
+    Example:    <ul>
+                  <li>This is element one</li>
+                  <li>This is a second element</li>
+                </ul>
+-->
+<!ELEMENT li            (#PCDATA)>
+
+<!--
+    Element:      b
+    Description:  Bold text
+
+    Example:    <b>this is bold</b>
+-->
+<!ELEMENT b             (#PCDATA)>
+
+<!--
+    Element:      i
+    Description:  Input text (blue)
+
+    Example:      The user has to type in <i>ls</i> to see.
+-->
+<!ELEMENT i             (#PCDATA)>
+
+<!-- 
+    Element:      br
+    Description:  hard line break
+
+    Example:      And then: <br/> 
+                  KABLAM!
+-->
+<!ELEMENT br            (#PCDATA)>
+
+<!-- 
+    Element:      license
+    Description:  Add license information
+
+    Example:      <license/>
+-->
+<!ELEMENT license       (EMPTY)>
+
+<!--
+    Element:      metadata
+    Description:  Metadata information for GLSAMaker
+
+    Example:      <metadata tag="approved">Level 1</metadata>
+
+    On request of plasmaroo, metadata can contain all elements again. 
+-->
+<!ELEMENT metadata  (#PCDATA|metadata)*>
+<!ATTLIST metadata tag      CDATA #REQUIRED
+                   revision CDATA #IMPLIED
+                   author   CDATA #IMPLIED
+                   timestamp CDATA #IMPLIED>