You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
docs: add docs for CVE-aware reboot recommendations feature - #18
This description is still too broad and makes the result ambiguous: coverage of CVEs in the running kernel does not establish that rebooting can wait when the next-boot kernel adds CVEs that the running kernel does not fix. Please state the actual condition used by the recommendation—Livepatch covers all CVEs fixed by the next-boot kernel that are not fixed by the running kernel—so this table agrees with the reboot-required explanation and message above.
Exit status 1 is not based on Livepatch covering CVEs in the running kernel alone; the recommendation compares the CVEs added by the next-boot kernel against the applied live patches. As written, this contradicts the protected-result description below and can tell operators that a reboot may wait even when the next boot kernel introduces uncovered CVEs. Please describe status 1 in terms of the next-boot kernel's CVEs.
This omits the running-kernel comparison that the algorithm described above relies on: coverage is required only for CVEs fixed by the next-boot kernel that are not already fixed by the running kernel. As written, readers may infer that Livepatch must cover every CVE in the next kernel before the reboot can wait.
The suppression condition is broader than the recommendation's actual evidence: the client compares Livepatch coverage only against CVEs added by the next-boot kernel relative to the running kernel, not against every CVE fixed by the next-boot kernel. Please state that qualifier here so this operational description matches the algorithm and the status output.
The policy's actual check is against CVEs introduced by the next-boot kernel relative to the running kernel. This wording can make the configuration behavior sound stricter than it is; please include the running-kernel qualifier, consistent with the recommendation explanation and status fields.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CHANGELOG.mdwith relevant non-documentation file changes?