[Lvfs-announce] VINCE auto-issues

Hi all,

I've just enabled a new plugin on the LVFS which automatically adds
VINCE issues to components where a matching CVE already exists.
There's nothing you need to do, but if you see issues added to your
component when firmware is signed then don't worry. The Component ->
Issues screen will say something like "Added on 2021-03-20 17:10:34 by
[email protected]" and that's because CERT already has a VU# issue for
that CVE. You might also notice we now log the user, and the
timestamp, for each added component issue.

In case you're interested, a VINCE ID is a superset ID that allows us
to tie together the same issue, but where different OEMs are using
different CVEs to track it. See
https://www.sei.cmu.edu/news-events/news/article.cfm?assetId=641759
for a good introduction. You can also add VINCE issues using <issue
type="vince">257161</issue> in the metadata.xml or by adding VU#
issues on the LVFS the same way you're adding INTEL-SA and CVE issues.

In the future, we'll also be using VINCE to enforce the firmware
embargo date for security issues, although we're waiting for new VINCE
permissions to be created to make that possible. I'll email with more
details about setting the restricted embargo timestamp when it's all
working.

Richard.