Contents of /bin/checklist

#!/usr/bin/perl
# Must run on a machine with madison.
# 
# To check for un-updated binary kernel packages, also needs grep-dctrl 
# and a Sources file for the distribution. Set the location of the Sources
# file in SOURCES_FILE in the environment.
use warnings;
use strict;
use URI::Escape;
use Getopt::Long;

my $html=0;
my $debug=0;
my $suite="testing";
my $sta="http://secure-testing.debian.net/debian-secure-testing/dists/etch/security-updates/main/source/Sources.gz";
my $output;
if (! GetOptions(
                "html" => \$html,
                "debug" => \$debug,
                "suite=s" => \$suite,
                "sta=s" => \$sta,
                "output=s", \$output)
    || ! @ARGV) {
        die "usage: $0 [--suite suite] [--sta sta-mirror] [--html] [--output=file] [--debug] list ...\n";
}

my $stasources=`tempfile`;
chomp $stasources;
system("wget -q -O $stasources $sta");

if (defined $output) {
        open (OUT, ">$output.tmp.$$") || die "output.tmp.$$: $!"; # Set the output to a file
}
else {
        open (OUT, ">&STDOUT"); # Set the output to stdout
}

if ($html) { # It's HTML, so we need a header
        print OUT "<html><title>$suite security issues</title>\n";
        
        # This is being run against something it's not meant to be, so print a warning
        if ($suite ne 'testing' && $suite ne 'unstable') { 
                print OUT <<"EOF";
<p>
<em>Warning:</em> This page is the result of running the testing security
check script against the $suite distribution. As data is only gathered for
the testing distribution, results may be innacurate if a package has
changed its name, if a vulnerability affects $suite and not testing, or if a
vulnerability has been fixed in $suite by the security team.
</p>
EOF
        }
        print OUT "<ul>\n";
}


my %data;
my %advlist;
my %needkernel=qw/2.4.27 0 2.6.11 0/;
my $list_unknown=1; #set to 1 to display kernel images with unknown source version
my $sources=$ENV{SOURCES_FILE};
my $need_rebuild=0;

# Set some colours for the urgency types
my @urgencies=("high", "medium", "low", "unimportant", "unknown", "fixed");
my %colormap=(
        high => "#FF0000",
        medium => "#FF9999",
        low => "#FFFFFF",
        unknown => "#FFFF00",
        fixed => "#00FF00",
);

my $unprop = my $unprop_all = my $unfixed = my $todos = my $fixedsta = 0;

# Add an item into the data array.
sub record {
        my ($package, $condition, $item, $urgency)=@_;

        if (! defined $item) {
                $item='';
        }
                
        if ($html) {
                $condition=~s{bug #(\d+)}{<a href="http://bugs.debian.org/$1">bug #$1</a>}g;
                $condition=~s{unfixed}{<b>unfixed</b>}g;
                $item=~s#((?:CAN|CVE)-\d+-\d+)#<a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=$1">$1</a>#g;
                $item=~s#(DTSA-\d+-\d+)#<a href="http://secure-testing-master.debian.net/DTSA/$1.html">$1</a>#g;
        }

        push @{$data{$package}{$condition}}, {item => $item, urgency => $urgency};
}

foreach my $list (@ARGV) {
        # Each of the @ARGVs we've got passed need parsing. So lets do that
        
        # If it's a directory, set the file to list, cause we need that.
        if (-d $list) {
                $list="$list/list";
        }
        
        my $id;
        open (IN, $list) || die "open $list: $!";
        while (<IN>) {
                print STDERR "line: $_" if $debug;
                chomp;
                if (/\s+TODO/) { # It's a todo item. Add it to the count, and ignore it
                        $todos++;
                }
                elsif (/^\[/) { # Checking adv. number for a line starting with [ : Set $id to it
                        ($id)=m/((?:DSA|DTSA|CAN|CVE)-[^\s]+) /;
                }
                elsif (/^((?:DSA|DTSA|CAN|CVE)-[^\s]+)/) { # Check for a line with an advisory at the start : Set $id to it
                        $id=$1;
                }
                elsif (/^\s+[!-]\s+(\S+)\s+(.*?)\s*$/) { # Deal with the rest of the lines
                        my $package=$1; # We know which package it is.
                        my $rest=$2; 
                        my $version;
                        my $notes;
                        if ($rest=~/([^\(\s]+)\s+\((.*)\)/) {
                                $version=$1;
                                $notes=$2;
                        }
                        elsif ($rest=~/\((.*)\)/) {
                                $version="";
                                $notes=$1;
                        }
                        else {
                                $version=$rest;
                                $notes="";
                        }

                        # by now, we also have the version that's affected by the security problem.
                        # This is stored in $version
                        next if $version eq '<not-affected>' || $version eq '<removed>';
                        
                        my @notes=split(/\s*;\s+/, $notes);

                        # Fetch the urgency, if we can.
                        my $urgency="unknown";
                        foreach my $u (@urgencies) {
                                if (grep { $_ eq $u } @notes) {
                                        $urgency=$u;
                                        @notes = grep { $_ ne $u } @notes;
                                        last;
                                }
                        }
                        next if $urgency eq 'unimportant';
                
                        # It's a kernel. Add it to the list of kernels that need to be looked at.
                        if ($package=~/kernel-source-([0-9.]+)/) {
                                my $kernversion=$1;
                                if (exists $needkernel{$kernversion} &&
                                    length $version &&
                                    system("dpkg --compare-versions $needkernel{$kernversion} lt $version") != 0) {
                                        $needkernel{$kernversion}=$version;
                                }
                        }

                        # Fire up madison.
                        my @maddy;
                        for (1..5) {
                                @maddy=`madison -s '$suite' '$package'`;
                                if ($? & 127 || ($? >> 8 != 0 && $? >> 8 != 1)) {
                                        # good old unrelaible newraff,
                                        # home of our archive..
                                        next;
                                }
                                last;
                        }
                        if ($? & 127) {
                                record($package, "<em>[madison segfaulted 5 times in a row.. Medic!]</em>", $id);
                        }
                        elsif ($? >> 8 != 0 && $? >> 8 != 1) {
                                record($package, "<em>[madison exited with ".($? >> 8)."]</em>", $id);
                        }
                        if (! @maddy) {
                                next;
                        }
                        
                        if ($version eq '<unfixed>' || grep { $_ eq 'pending' } @notes) {
                                record($package, '('.join("; ", "unfixed", @notes).')', $id, $urgency);
                                $unfixed++;
                                # It's not been fixed!
                        }
                        else {
                                foreach my $maddy (@maddy) {
                                        my @fields = split(/\s*\|\s*/, $maddy);
                                        my $havver=$fields[1]; # It's this version in the archive I'm checking.
                                        my $arches=$fields[3];
                                        $version=~s/\s+//; # strip whitespace
                                        $arches=~s/\s+$//;
                                        # Is the version in the archive the same or newer than the fix?
                                        my $cmp=system("dpkg --compare-versions '$havver' '>=' '$version'"); 
                                        if ($cmp != 0){ # No, so the archive is vulnerable.
                                                # Does the version exist in the secure-testing archive?
                                                my $staversion = `zcat $stasources |grep-dctrl -F Package -e ^$package\$ -s Version -`;
                                                chomp $staversion;
                                                $staversion=~s/Version: //;
                                                $staversion=~s/\s+//;
                                                if (length ($staversion)) {
                                                        # Yes, but what version is in s-t?
                                                        my $stacmp = system("dpkg --compare-versions '$staversion' '>=' '$version'");
                                                        if ($stacmp == 0){
                                                                # Well, the version in the s-t archive fixes the issue
                                                                # but it's still vulnerable in the main archive
                                                                $urgency='fixed';
                                                                $fixedsta++;
                                                        }
                                                }
                                                
                                                if ($html && $suite eq 'testing') {
                                                        $havver='<a href="http://bjorn.haxx.se/debian/testing.pl?package='.uri_escape($package).'">'.$havver.'</a>';
                                                }
                                                record($package, "$version needed, have $havver".(@maddy > 1 ? " [$arches]" : ""), $id, $urgency);
                                                $unprop++;
                                                $unprop_all++ unless @maddy > 1;
                                        }
                                }
                        }
                }
        }
}


foreach my $package (sort keys %data) {
        foreach my $condition (sort keys %{$data{$package}}) {
                print OUT "<li>" if $html;
                print OUT "$package $condition for ";
                my $items=0;
                foreach my $i (sort @{$data{$package}{$condition}}) {
                        print OUT ", " if $items > 0;
                        
                        if ($html) {
                                my $color=$colormap{$i->{urgency}};
                                print OUT "<span style=\"background:$color\">";
                        }
                        print OUT $i->{item};
                        if ($html) {
                                print OUT "</span>";
                        }
                        
                        $items++;
                }
                print OUT "\n";
        }
}

my %needkern;

foreach my $version (sort keys %needkernel) {
        my %images;
        
        if (defined $needkern{$version} && $needkern{$version} eq "0") {
                next;
        }

        my @dctrl;
        if (defined $sources && length $sources) {
                my $cat=($sources=~/\.gz/) ? "zcat" : "cat";
                @dctrl=`$cat $sources | grep-dctrl -F Binary kernel-image-$version -s Package,Build-Depends -`;
        }

        my $package="";
        my $haveversion;
        
        foreach my $line (@dctrl) {
                chomp $line;
                if ($line=~/Package:\s*(\S+)/) {
                        $package=$1;
                        $haveversion="0";
                } elsif ($line=~/Build-Depends/) {
                        if ($line=~/kernel-tree-$version-([^,\s]+)/) {
                                $haveversion="$version-$1";
                        } elsif ($line=~/kernel-source-$version\s+\(>?=\s*([^\s\)]+)\)/) {
                                $haveversion="$1";
                        }
                } else {
                        if ($package=~/linux-kernel-di/ || $package eq "") {
                                next;
                        }
                        $images{$package}=$haveversion;
                        $package="";
                }
        }

        foreach my $package (sort keys %images) {
                if ($images{$package} eq "0") {
                        print OUT "<li>" if ($html && $list_unknown);
                        print OUT "$package built from kernel-source-$version $needkernel{$version} needed, current version unknown\n" if $list_unknown;
                } elsif (!system("dpkg --compare-versions $needkernel{$version} gt $images{$package}")) {
                        print OUT "<li>" if $html;
                        print OUT "$package built from kernel-source-$version $needkernel{$version} needed, have $images{$package}\n";
                        $need_rebuild++;
                }
        }


}


if ($html) {
        print OUT "</ul>\n";
        print OUT "<hr>\n";
        print OUT "Key: ";
        foreach my $keyline (@urgencies) {
                next if $keyline eq 'unimportant';
                print OUT "<span style=\"border: 1px dashed; background:".$colormap{$keyline}."\">&nbsp;$keyline&nbsp;</span> ";
        }
        print OUT "<br>";
        print OUT "Total holes unfixed: $unfixed<br>\n";
        print OUT "Total holes fixed in unstable but not $suite: $unprop_all ($fixedsta fixed in secure-testing archive)";
        if ($unprop_all != $unprop) {
                print OUT " (+".($unprop - $unprop_all)." on some arches)";
        }
        print OUT "<br>\n";
        print OUT "Total number of kernel image packages not up to date: $need_rebuild<br>\n";
        print OUT "Number of TODO lines in <a href=\"http://svn.debian.org/wsvn/secure-testing/data/?rev=0&sc=0\">records</a>: $todos<br>\n";
        print OUT "Maintained by the <a href=\"http://secure-testing-master.debian.net/\">testing security team</a><br>\n";
        print OUT "Last update: ".`date`."<br>\n";
        print OUT "</html>\n";
}

close OUT;
if (defined $output) {
        rename("$output.tmp.$$", $output) || die "rename: $!";
}
unlink $stasources;
1	joeyh	2	#!/usr/bin/perl
2			# Must run on a machine with madison.
3	joeyh	644	#
4			# To check for un-updated binary kernel packages, also needs grep-dctrl
5			# and a Sources file for the distribution. Set the location of the Sources
6			# file in SOURCES_FILE in the environment.
7	joeyh	1765	use warnings;
8			use strict;
9	joeyh	256	use URI::Escape;
10	joeyh	1278	use Getopt::Long;
11	joeyh	2
12	joeyh	230	my $html=0;
13	joeyh	1280	my $debug=0;
14	joeyh	1281	my $suite="testing";
15	neilm	2253	my $sta="http://secure-testing.debian.net/debian-secure-testing/dists/etch/security-updates/main/source/Sources.gz";
16	joeyh	1279	my $output;
17			if (! GetOptions(
18			"html" => \$html,
19	joeyh	1280	"debug" => \$debug,
20	joeyh	1279	"suite=s" => \$suite,
21	neilm	1763	"sta=s" => \$sta,
22	joeyh	1279	"output=s", \$output)
23			\|\| ! @ARGV) {
24	neilm	1763	die "usage: $0 [--suite suite] [--sta sta-mirror] [--html] [--output=file] [--debug] list ...\n";
25	joeyh	230	}
26
27	joeyh	1766	my $stasources=`tempfile`;
28			chomp $stasources;
29			system("wget -q -O $stasources $sta");
30	neilm	1763
31	joeyh	1279	if (defined $output) {
32	neilm	1763	open (OUT, ">$output.tmp.$$") \|\| die "output.tmp.$$: $!"; # Set the output to a file
33	joeyh	1279	}
34			else {
35	neilm	1763	open (OUT, ">&STDOUT"); # Set the output to stdout
36	joeyh	1279	}
37
38	neilm	1763	if ($html) { # It's HTML, so we need a header
39	joeyh	1279	print OUT "<html><title>$suite security issues</title>\n";
40	neilm	1763
41			# This is being run against something it's not meant to be, so print a warning
42			if ($suite ne 'testing' && $suite ne 'unstable') {
43	joeyh	1279	print OUT <<"EOF";
44			<p>
45			<em>Warning:</em> This page is the result of running the testing security
46			check script against the $suite distribution. As data is only gathered for
47	joeyh	1285	the testing distribution, results may be innacurate if a package has
48	joeyh	1279	changed its name, if a vulnerability affects $suite and not testing, or if a
49	joeyh	1767	vulnerability has been fixed in $suite by the security team.
50	joeyh	1279	</p>
51			EOF
52			}
53			print OUT "<ul>\n";
54			}
55
56
57	joeyh	307	my %data;
58	neilm	1763	my %advlist;
59	joeyh	1222	my %needkernel=qw/2.4.27 0 2.6.11 0/;
60	stef-guest	688	my $list_unknown=1; #set to 1 to display kernel images with unknown source version
61	joeyh	644	my $sources=$ENV{SOURCES_FILE};
62			my $need_rebuild=0;
63
64	neilm	1763	# Set some colours for the urgency types
65	joeyh	1900	my @urgencies=("high", "medium", "low", "unimportant", "unknown", "fixed");
66	joeyh	1243	my %colormap=(
67			high => "#FF0000",
68			medium => "#FF9999",
69			low => "#FFFFFF",
70	joeyh	1889	unknown => "#FFFF00",
71	joeyh	1888	fixed => "#00FF00",
72	joeyh	1243	);
73
74	neilm	1763	my $unprop = my $unprop_all = my $unfixed = my $todos = my $fixedsta = 0;
75	joeyh	307
76	neilm	1763	# Add an item into the data array.
77	joeyh	307	sub record {
78	joeyh	1242	my ($package, $condition, $item, $urgency)=@_;
79	joeyh	1770
80			if (! defined $item) {
81			$item='';
82			}
83	joeyh	307
84	joeyh	231	if ($html) {
85	joeyh	307	$condition=~s{bug #(\d+)}{<a href="http://bugs.debian.org/$1">bug #$1</a>}g;
86	joeyh	311	$condition=~s{unfixed}{<b>unfixed</b>}g;
87	joeyh	1770	$item=~s#((?:CAN\|CVE)-\d+-\d+)#<a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=$1">$1</a>#g;
88	joeyh	1809	$item=~s#(DTSA-\d+-\d+)#<a href="http://secure-testing-master.debian.net/DTSA/$1.html">$1</a>#g;
89	joeyh	231	}
90	joeyh	307
91	joeyh	1242	push @{$data{$package}{$condition}}, {item => $item, urgency => $urgency};
92	joeyh	230	}
93
94	neilm	1763	foreach my $list (@ARGV) {
95			# Each of the @ARGVs we've got passed need parsing. So lets do that
96
97			# If it's a directory, set the file to list, cause we need that.
98	joeyh	31	if (-d $list) {
99			$list="$list/list";
100	joeyh	2	}
101	joeyh	31
102	joeyh	1771	my $id;
103	joeyh	31	open (IN, $list) \|\| die "open $list: $!";
104			while (<IN>) {
105	joeyh	1280	print STDERR "line: $_" if $debug;
106	joeyh	31	chomp;
107	neilm	1763	if (/\s+TODO/) { # It's a todo item. Add it to the count, and ignore it
108			$todos++;
109			}
110			elsif (/^\[/) { # Checking adv. number for a line starting with [ : Set $id to it
111	joeyh	1660	($id)=m/((?:DSA\|DTSA\|CAN\|CVE)-[^\s]+) /;
112	joeyh	2	}
113	neilm	1763	elsif (/^((?:DSA\|DTSA\|CAN\|CVE)-[^\s]+)/) { # Check for a line with an advisory at the start : Set $id to it
114	joeyh	242	$id=$1;
115	joeyh	31	}
116	neilm	1763	elsif (/^\s+[!-]\s+(\S+)\s+(.?)\s$/) { # Deal with the rest of the lines
117			my $package=$1; # We know which package it is.
118			my $rest=$2;
119	joeyh	1242	my $version;
120			my $notes;
121			if ($rest=~/([^\(\s]+)\s+\((.*)\)/) {
122			$version=$1;
123			$notes=$2;
124			}
125			elsif ($rest=~/\((.*)\)/) {
126			$version="";
127			$notes=$1;
128			}
129			else {
130			$version=$rest;
131			$notes="";
132			}
133	neilm	1763
134			# by now, we also have the version that's affected by the security problem.
135			# This is stored in $version
136	joeyh	2305	next if $version eq '<not-affected>' \|\| $version eq '<removed>';
137	joeyh	1887
138	joeyh	1242	my @notes=split(/\s*;\s+/, $notes);
139
140	neilm	1763	# Fetch the urgency, if we can.
141	joeyh	1242	my $urgency="unknown";
142			foreach my $u (@urgencies) {
143			if (grep { $_ eq $u } @notes) {
144			$urgency=$u;
145			@notes = grep { $_ ne $u } @notes;
146			last;
147			}
148			}
149	joeyh	1900	next if $urgency eq 'unimportant';
150	neilm	1763
151			# It's a kernel. Add it to the list of kernels that need to be looked at.
152	joeyh	644	if ($package=~/kernel-source-([0-9.]+)/) {
153			my $kernversion=$1;
154	joeyh	1283	if (exists $needkernel{$kernversion} &&
155			length $version &&
156			system("dpkg --compare-versions $needkernel{$kernversion} lt $version") != 0) {
157			$needkernel{$kernversion}=$version;
158	joeyh	644	}
159			}
160
161	neilm	1763	# Fire up madison.
162	joeyh	657	my @maddy;
163			for (1..5) {
164	joeyh	1278	@maddy=`madison -s '$suite' '$package'`;
165	joeyh	659	if ($? & 127 \|\| ($? >> 8 != 0 && $? >> 8 != 1)) {
166			# good old unrelaible newraff,
167			# home of our archive..
168	joeyh	657	next;
169			}
170			last;
171			}
172	joeyh	654	if ($? & 127) {
173	joeyh	657	record($package, "<em>[madison segfaulted 5 times in a row.. Medic!]</em>", $id);
174	joeyh	564	}
175			elsif ($? >> 8 != 0 && $? >> 8 != 1) {
176	joeyh	654	record($package, "<em>[madison exited with ".($? >> 8)."]</em>", $id);
177	joeyh	564	}
178	joeyh	657	if (! @maddy) {
179	joeyh	307	next;
180			}
181	joeyh	241
182	joeyh	2145	if ($version eq '<unfixed>' \|\| grep { $_ eq 'pending' } @notes) {
183			record($package, '('.join("; ", "unfixed", @notes).')', $id, $urgency);
184	joeyh	257	$unfixed++;
185	neilm	1763	# It's not been fixed!
186	joeyh	2	}
187	joeyh	241	else {
188	joeyh	657	foreach my $maddy (@maddy) {
189			my @fields = split(/\s\\|\s/, $maddy);
190	neilm	1763	my $havver=$fields[1]; # It's this version in the archive I'm checking.
191	joeyh	657	my $arches=$fields[3];
192			$version=~s/\s+//; # strip whitespace
193			$arches=~s/\s+$//;
194	joeyh	1767	# Is the version in the archive the same or newer than the fix?
195	neilm	1763	my $cmp=system("dpkg --compare-versions '$havver' '>=' '$version'");
196			if ($cmp != 0){ # No, so the archive is vulnerable.
197			# Does the version exist in the secure-testing archive?
198	joeyh	1766	my $staversion = `zcat $stasources \|grep-dctrl -F Package -e ^$package\$ -s Version -`;
199	neilm	1763	chomp $staversion;
200			$staversion=~s/Version: //;
201			$staversion=~s/\s+//;
202			if (length ($staversion)) {
203			# Yes, but what version is in s-t?
204			my $stacmp = system("dpkg --compare-versions '$staversion' '>=' '$version'");
205			if ($stacmp == 0){
206			# Well, the version in the s-t archive fixes the issue
207			# but it's still vulnerable in the main archive
208	joeyh	1888	$urgency='fixed';
209	neilm	1763	$fixedsta++;
210			}
211	neilm	1750	}
212	neilm	1763
213	joeyh	1278	if ($html && $suite eq 'testing') {
214	joeyh	657	$havver='<a href="http://bjorn.haxx.se/debian/testing.pl?package='.uri_escape($package).'">'.$havver.'</a>';
215			}
216	joeyh	1888	record($package, "$version needed, have $havver".(@maddy > 1 ? " [$arches]" : ""), $id, $urgency);
217	joeyh	657	$unprop++;
218	joeyh	735	$unprop_all++ unless @maddy > 1;
219	joeyh	230	}
220	joeyh	31	}
221			}
222	joeyh	2	}
223			}
224			}
225	joeyh	230
226	joeyh	307
227			foreach my $package (sort keys %data) {
228			foreach my $condition (sort keys %{$data{$package}}) {
229	joeyh	1279	print OUT "<li>" if $html;
230			print OUT "$package $condition for ";
231	joeyh	307	my $items=0;
232	joeyh	1242	foreach my $i (sort @{$data{$package}{$condition}}) {
233	joeyh	1279	print OUT ", " if $items > 0;
234	joeyh	1242
235			if ($html) {
236	joeyh	1243	my $color=$colormap{$i->{urgency}};
237	joeyh	1279	print OUT "<span style=\"background:$color\">";
238	joeyh	1242	}
239	joeyh	1279	print OUT $i->{item};
240	joeyh	1243	if ($html) {
241	joeyh	1279	print OUT "</span>";
242	joeyh	1243	}
243	joeyh	1242
244	joeyh	307	$items++;
245			}
246	joeyh	1279	print OUT "\n";
247	joeyh	307	}
248			}
249
250	joeyh	1765	my %needkern;
251
252	joeyh	644	foreach my $version (sort keys %needkernel) {
253			my %images;
254
255	joeyh	1772	if (defined $needkern{$version} && $needkern{$version} eq "0") {
256	joeyh	644	next;
257			}
258
259			my @dctrl;
260			if (defined $sources && length $sources) {
261	joeyh	645	my $cat=($sources=~/\.gz/) ? "zcat" : "cat";
262			@dctrl=`$cat $sources \| grep-dctrl -F Binary kernel-image-$version -s Package,Build-Depends -`;
263	joeyh	644	}
264
265			my $package="";
266			my $haveversion;
267
268			foreach my $line (@dctrl) {
269	joeyh	1769	chomp $line;
270	joeyh	644	if ($line=~/Package:\s*(\S+)/) {
271			$package=$1;
272			$haveversion="0";
273			} elsif ($line=~/Build-Depends/) {
274			if ($line=~/kernel-tree-$version-([^,\s]+)/) {
275			$haveversion="$version-$1";
276	stef-guest	687	} elsif ($line=~/kernel-source-$version\s+\(>?=\s*([^\s\)]+)\)/) {
277	joeyh	644	$haveversion="$1";
278			}
279			} else {
280			if ($package=~/linux-kernel-di/ \|\| $package eq "") {
281			next;
282			}
283			$images{$package}=$haveversion;
284			$package="";
285			}
286			}
287
288	joeyh	1765	foreach my $package (sort keys %images) {
289	joeyh	644	if ($images{$package} eq "0") {
290	joeyh	1279	print OUT "<li>" if ($html && $list_unknown);
291			print OUT "$package built from kernel-source-$version $needkernel{$version} needed, current version unknown\n" if $list_unknown;
292	joeyh	644	} elsif (!system("dpkg --compare-versions $needkernel{$version} gt $images{$package}")) {
293	joeyh	1772	print OUT "<li>" if $html;
294	joeyh	1279	print OUT "$package built from kernel-source-$version $needkernel{$version} needed, have $images{$package}\n";
295	joeyh	644	$need_rebuild++;
296			}
297			}
298
299
300			}
301
302
303	joeyh	307	if ($html) {
304	joeyh	1279	print OUT "</ul>\n";
305			print OUT "<hr>\n";
306	neilm	1763	print OUT "Key: ";
307	joeyh	1765	foreach my $keyline (@urgencies) {
308	joeyh	1902	next if $keyline eq 'unimportant';
309	neilm	1763	print OUT "<span style=\"border: 1px dashed; background:".$colormap{$keyline}."\"> $keyline </span> ";
310			}
311			print OUT "<br>";
312	joeyh	1279	print OUT "Total holes unfixed: $unfixed<br>\n";
313	neilm	1763	print OUT "Total holes fixed in unstable but not $suite: $unprop_all ($fixedsta fixed in secure-testing archive)";
314	joeyh	735	if ($unprop_all != $unprop) {
315	joeyh	1279	print OUT " (+".($unprop - $unprop_all)." on some arches)";
316	joeyh	735	}
317	joeyh	1279	print OUT "<br>\n";
318			print OUT "Total number of kernel image packages not up to date: $need_rebuild<br>\n";
319			print OUT "Number of TODO lines in <a href=\"http://svn.debian.org/wsvn/secure-testing/data/?rev=0&sc=0\">records</a>: $todos<br>\n";
320	joeyh	1838	print OUT "Maintained by the <a href=\"http://secure-testing-master.debian.net/\">testing security team</a><br>\n";
321	joeyh	1279	print OUT "Last update: ".`date`."<br>\n";
322			print OUT "</html>\n";
323	joeyh	230	}
324	joeyh	1279
325			close OUT;
326			if (defined $output) {
327			rename("$output.tmp.$$", $output) \|\| die "rename: $!";
328			}
329	joeyh	1982	unlink $stasources;