Extend lts-cve-triage.py to identify CVEs covered by a DLA and not a DSA
The goal is to improve the way we handle CVEs being fixed in LTS so that those same CVEs also get fixed in (old)stable.
In general, when a package is triaged for LTS and when some of those CVEs have been marked no-dsa for (old)stable then the person claiming the package and working on it is able to immediately also begin coordinating the maintainer and/or (O)SRM for an upload to proposed-updates. However, when a DLA is completed before the security team makes their triage decision or when the person doing the LTS work overlooks no-dsa CVEs, we may end with a situation where CVEs are fixed in LTS and those same CVEs remain unfixed in (old)stable.
The lts-cve-triage.py
script should be extended to identify CVEs which have been fixed by a DLA and where the same CVE is marked as no-dsa, postponed or another status which indicates that the vulnerability is still present but that the secteam cannot or will not handle it.
Once this is implemented it will become part of the FD responsibility to ensure that those doing LTS work are notified when they may have added responsibility to go back and coordinate an upload to proposed-updates for a CVE they previously fixed in a DLA.