Add a tool and skill for updating the gVisor CVE track record YAML.

This change introduces a Go binary `update_cve_track_record` that can parse, update/insert, sort, and re-encode entries in the website's `_data/cve-track-record.yml`. The tool ensures proper formatting and sorting of CVE entries.

A new `SKILL.md` file is also added, providing a step-by-step guide on how to use this tool to manage CVE entries, including gathering necessary details and running validation tests after updating the YAML file.

PiperOrigin-RevId: 944802032

tools/yamltest/defs.bzl

@@ -6,10 +6,11 @@ def _yaml_test_impl(ctx):
     ctx.actions.write(runner, "\n".join([
         "#!/bin/bash",
         "set -euo pipefail",
-        "%s '-schema=%s' -strict=%s -- %s" % (
+        "%s '-schema=%s' -strict=%s -disallow_comments=%s -- %s" % (
             ctx.files._tool[0].short_path,
             ctx.files.schema[0].short_path,
             "true" if ctx.attr.strict else "false",
+            "true" if ctx.attr.disallow_comments else "false",
             " ".join([f.short_path for f in ctx.files.srcs]),
         ),
     ]), is_executable = True)
@@ -37,6 +38,11 @@ yaml_test = rule(
             mandatory = False,
             default = True,
         ),
+        "disallow_comments": attr.bool(
+            doc = "Whether to disallow comments in the YAML file.",
+            mandatory = False,
+            default = False,
+        ),
         "_tool": attr.label(
             executable = True,
             cfg = "target",

tools/yamltest/main.go

@@ -28,10 +28,37 @@ import (
 )
 
 var (
-	schema = flag.String("schema", "", "path to JSON schema file.")
-	strict = flag.Bool("strict", true, "Whether to enable strict mode for YAML decoding")
+	schema           = flag.String("schema", "", "path to JSON schema file.")
+	strict           = flag.Bool("strict", true, "Whether to enable strict mode for YAML decoding")
+	disallowComments = flag.Bool("disallow_comments", false, "Whether to disallow comments in the YAML file")
 )
 
+func hasComments(data []byte) bool {
+	inDoubleQuotes := false
+	inSingleQuotes := false
+	escaped := false
+	for _, b := range data {
+		if escaped {
+			escaped = false
+			continue
+		}
+		if b == '\\' {
+			escaped = true
+			continue
+		}
+		if b == '"' && !inSingleQuotes {
+			inDoubleQuotes = !inDoubleQuotes
+		}
+		if b == '\'' && !inDoubleQuotes {
+			inSingleQuotes = !inSingleQuotes
+		}
+		if b == '#' && !inDoubleQuotes && !inSingleQuotes {
+			return true
+		}
+	}
+	return false
+}
+
 func fixup(v any) (any, error) {
 	switch x := v.(type) {
 	case map[any]any:
@@ -104,6 +131,16 @@ func main() {
 		// Record the filename with an empty slice for below, where
 		// we will emit all files (even those without any errors).
 		allErrors[filename] = nil
+		if *disallowComments {
+			data, err := os.ReadFile(filename)
+			if err != nil {
+				allErrors[filename] = append(allErrors[filename], err)
+				continue
+			}
+			if hasComments(data) {
+				allErrors[filename] = append(allErrors[filename], errors.New("YAML comments are disallowed in this file"))
+			}
+		}
 		documentLoader, err := loadFile(filename)
 		if err != nil {
 			allErrors[filename] = append(allErrors[filename], err)

website/BUILD

@@ -222,5 +222,6 @@ bzl_library(
 yaml_test(
     name = "cve_track_record_test",
     srcs = ["_data/cve-track-record.yml"],
+    disallow_comments = True,
     schema = "//website:cve-track-record.schema.json",
 )

website/cve-track-record.schema.json

@@ -27,11 +27,11 @@
           "type": "string"
         },
         "risk": {
-          "description": "Escalation vector.",
+          "description": "The escalation vector or risk category (e.g. Pod-to-guest escalation, Information leakage, Denial of service, Local privilege escalation, Network policy bypass).",
           "type": "string"
         },
         "scope": {
-          "description": "Target ecosystem scope.",
+          "description": "The target ecosystem scope affected by the CVE (e.g., All Linux VMs, All Linux containers, gVisor Sentry).",
           "type": "string"
         },
         "cve": {
@@ -46,7 +46,7 @@
           ]
         },
         "exploitable_under_gvisor": {
-          "description": "Whether the vulnerability is exploitable under gVisor.",
+          "description": "Whether the vulnerability is exploitable under gVisor (true if gVisor itself is vulnerable or if the vulnerability can escape the gVisor boundary; false if gVisor is immune, shields the host, or doesn't implement the vulnerable functionality).",
           "type": "boolean"
         },
         "patched": {