From 9eca8a924f3d876a864fbc7ece8e7b3b09b9c771 Mon Sep 17 00:00:00 2001
From: Bernhard Reiter <bernhard@intevation.de>
Date: Tue, 17 May 2022 16:08:38 +0200
Subject: [PATCH] Improved searching for provider-metadata.json

* Changes order to try the DNS path after security.txt.
* Add diagnostic output which URL is looked for.
---
 cmd/csaf_checker/processor.go | 47 ++++++++++++++++++++---------------
 1 file changed, 27 insertions(+), 20 deletions(-)

diff --git a/cmd/csaf_checker/processor.go b/cmd/csaf_checker/processor.go
index 957e2bd..fd2e0a4 100644
--- a/cmd/csaf_checker/processor.go
+++ b/cmd/csaf_checker/processor.go
@@ -729,6 +729,7 @@ func (p *processor) locateProviderMetadata(
 	client := p.httpClient()
 
 	tryURL := func(url string) (bool, error) {
+		log.Printf("Trying: %v\n", url)
 		res, err := client.Get(url)
 		if err != nil || res.StatusCode != http.StatusOK ||
 			res.Header.Get("Content-Type") != "application/json" {
@@ -762,32 +763,38 @@ func (p *processor) locateProviderMetadata(
 	// Read from security.txt
 
 	path := "https://" + domain + "/.well-known/security.txt"
+	log.Printf("Searching in: %v\n", path)
 	res, err := client.Get(path)
-	if err != nil {
-		return err
-	}
+	if err == nil && res.StatusCode == http.StatusOK {
+		loc, err := func() (string, error) {
+			defer res.Body.Close()
+			return p.extractProviderURL(res.Body)
+		}()
 
-	if res.StatusCode != http.StatusOK {
-		return nil
-	}
+		if err != nil {
+			log.Printf("did not find provider URL in /.well-known/security.txt, error: %v\n", err)
+		}
 
-	loc, err := func() (string, error) {
-		defer res.Body.Close()
-		return p.extractProviderURL(res.Body)
-	}()
-
-	if err != nil {
-		log.Printf("error: %v\n", err)
-		return nil
-	}
-
-	if loc != "" {
-		if _, err = tryURL(loc); err == errContinue {
-			err = nil
+		if loc != "" {
+			if _, err = tryURL(loc); err == errContinue {
+				err = nil
+			}
+			return err
 		}
 	}
 
-	return err
+	// Read from DNS path
+
+	path = "https://csaf.data.security." + domain
+	ok, err := tryURL(path)
+	if err != nil {
+		return err
+	}
+	if ok {
+		return nil
+	}
+
+	return errStop
 }
 
 func (p *processor) extractProviderURL(r io.Reader) (string, error) {