1
0
Fork 0
mirror of https://github.com/gocsaf/csaf.git synced 2025-12-22 11:55:40 +01:00
Commit graph

203 commits

Author SHA1 Message Date
Sascha L. Teichmann
20f5937240
Only create/update index.txt, changes.csv, security.txt when configured. (#210)
* Change default to not write index.txt, changes.csv and security.txt 
  (for provider and aggregator)
* Add config file options to reenable writing.
2022-07-05 16:44:45 +02:00
Bernhard Reiter
b95cd0db74
Fix minor typos in comments and bump (c) year 2022-06-27 17:26:52 +02:00
JanHoefelmeyer
38d3679704
Add hint if provider is called outside of CGI
Co-authored-by: Sascha L. Teichmann <sascha.teichmann@intevation.de>
2022-06-23 17:27:25 +02:00
Sascha L. Teichmann
f8ce08a26e
Download advisories to label/year folders 2022-06-23 15:04:49 +02:00
Sascha L. Teichmann
0b19782374
Remove csaf_remote_validator 2022-06-23 14:49:54 +02:00
Sascha L. Teichmann
b359fd0a62
Add CSAF downloader
* Dense and refactor ROLIE code in aggregator a bit.
* Move  advisory file processor to csaf package.
* Fix minor typo on main readme
2022-06-23 14:14:44 +02:00
JanHoefelmeyer
640ef64df9
Changes phrasing of output from csaf_checker if security.txt was found (#196)
Co-authored-by: Jan Höfelmeyer <Jan Höfelmeyer jhoefelmeyer@intevation.de>
2022-06-23 11:07:02 +02:00
Sascha L. Teichmann
78d8b89aca
Add support for remote validation services. (#185)
* Simple tool to test the remote validation

* Added remote validator support to provider.

* Added remote validation to aggregator.

* Calm golint

* Removed csaf_remote_validator tool as it was only for dev.

* Re-added csaf_remote_validator tool. Testing is not done.

* Embed the document entirely

* Include testing the remote validator in the Itests

* Change permission of the script

* Remove code for Itests

* As these will be done in another branch

Co-authored-by: Fadi Abbud <fadi.abbud@intevation.de>
2022-06-21 14:47:06 +02:00
Sascha L. Teichmann
fa434fa039
Improve checker regarding ROLIE feed advisory URLs, hashes and signatures
* Add checking the  ROLIE feed advisory URLs, hashes and signatures.
2022-06-14 13:41:51 +02:00
Bernhard E. Reiter
2961a70bf2
Change OpenPGP signatures to be without headers (#183)
* Change options when creating the armored version of the signature
   to leave out the optional headers, which would be `Version:`
   and `Comment:`, as it is considered uncommon for a while now to
   set these.
2022-06-14 13:18:42 +02:00
Sascha L. Teichmann
589547fa94
Improve writing ROLIE feed documents
* Add signature and two time has as link rel attributes to each rolie entry
   for provider and aggregator. Thus following CSAF 2.0 csd02. 
resolve #74
2022-06-14 09:50:36 +02:00
tschmidtb51
22b945a3c3
Improve provider example configuration and docs
* Change "Organization" to include the string "Company" to reflect common sense of category "vendor"
2022-06-14 08:58:11 +02:00
Fadi Abbud
1344885092
Change message type of tlps fetching error (#175)
* #171
2022-06-10 12:03:08 +02:00
Fadi Abbud
714814a44b
Fix datetime format (#174)
* #173
2022-06-10 10:57:08 +02:00
Bernhard Reiter
5ca768b5e2
Improve checker's html datetime output
* Change the displayed string in the HTML output
   for the date and time of the run
   to be human readable and in the local timezone.
   The `datetime` attribute of the `time` tag still has the RFC 3339 UTC
   version for machine processing.
2022-06-10 09:49:00 +02:00
Sascha L. Teichmann
6ec2131f5d
Fix datetime in checker reports
* Change how the datetime is generated for the report.

Co-authored-by: Bernhard Reiter <bernhard@intevation.de>
2022-06-09 17:17:43 +02:00
Sascha L. Teichmann
922e468d99
Compare fingerprints case-insensitive 2022-06-09 16:30:20 +02:00
Sascha L. Teichmann
c09e5f66f3
Add type to checker messages
* Add a type to checker messages, so the results can be interpreted better.
   Especially the difference between warning and errors can be used.
2022-06-09 12:26:19 +02:00
Sascha L. Teichmann
69f0f3499a
Change openpgp key providing code to use local directory
* Adjust provider and aggregator to copy the used openpgp pubkey into a locally
  provided directory `openpgp` beside the `prodiver-metadata.json`.
  This more robust and self-reliant than using a public pubkey server,
  which is the reason why the CSAF 2.0 csd02 mentions it as example in
  "7.1.20 Requirement 20: Public OpenPGP Key".
 * Improve aggregator by removing a typo `aggreator` from one written paths.
   (Done with this change as it also affects the openpgp/ paths writing.)

solve #85
2022-06-09 10:42:44 +02:00
Bernhard E. Reiter
a849ac0d5f
Improve https get diagnostics, add verbose option
* Implement a logging client and activate it using verbose parameter or option
   in checker and aggregator.

Co-authored-by: Sascha L. Teichmann <sascha.teichmann@intevation.de>
2022-06-02 15:07:55 +02:00
Sascha L. Teichmann
c0aa7edc70
Improve code style
* Remove unnecessary brackets in logical comparison.
2022-06-01 09:15:31 +02:00
Sascha L. Teichmann
527a6f6005
Implement better search for provider-metadata.json
* Decouple loading of provider metadata from processor and moved in the base library.
* Integrate new code into checker and aggregator
* Adhere to csd02 revision of CSAF 2.0.

resolve #60
2022-05-31 18:10:18 +02:00
Bernhard Reiter
dca6f2c5c4
Improve version number in checker html result 2022-05-31 17:25:20 +02:00
Bernhard Reiter
b3759b8f9e
Improve version info in checker html result 2022-05-31 17:22:39 +02:00
Sascha L. Teichmann
f823d71ec5
Replace deprecated terminal import 2022-05-31 16:18:28 +02:00
Fadi Abbud
406366e0bd Add short form of flag and description 2022-05-31 08:56:07 +02:00
Sascha L. Teichmann
bc90389090 Use factored out rate throttling client in checker. 2022-05-30 23:25:21 +02:00
Sascha L. Teichmann
07ab770a35 Factored throttling client out of aggregator. 2022-05-30 23:12:08 +02:00
Fadi Abbud
a1036c3847 Add 'Rate' config option for download throttling (Checker) 2022-05-30 13:38:29 +02:00
Sascha L. Teichmann
86070629e2 Forget to add indices in aggregator. 2022-05-25 14:41:30 +02:00
Sascha L. Teichmann
a63911be41 Fix wrong content of ROLIE link 2022-05-25 12:30:33 +02:00
Sascha L. Teichmann
de595f5da9 Add missing category list in ROLIE feeds. Resolves issue #41 2022-05-25 10:17:17 +02:00
Fadi Abbud
13423c3d4d
Add datetime and version info to report of checker
Resolve #142 

Co-authored-by: Bernhard Reiter <bernhard@intevation.de>
2022-05-24 16:59:27 +02:00
Sascha L. Teichmann
17f22855ee
Add filename conformity check
* Add util function to check a filename for confirming to csaf-v2.0-csd02.
* Add code to reject bad filenames in provider, checker, aggregator and uploader.
2022-05-20 18:57:27 +02:00
Sascha L. Teichmann
a50ed4ab01 Write correct url prefix to provider-metadata. 2022-05-19 12:22:06 +02:00
Sascha L. Teichmann
6295466ef5 Partially role back last commit. WIP 2022-05-19 11:33:11 +02:00
Sascha L. Teichmann
c69709c1ec Move ROLIE feed to respective folder. For Issue #143, #144 2022-05-19 10:20:20 +02:00
Sascha L. Teichmann
d779a3fd7e
Merge pull request #135 from csaf-poc/link-checker
Link checker
2022-05-17 17:26:35 +02:00
Sascha L. Teichmann
16556cd8bb check each advisory is listable 2022-05-17 17:20:43 +02:00
Bernhard Reiter
9eca8a924f
Improved searching for provider-metadata.json
* Changes order to try the DNS path after security.txt.
* Add diagnostic output which URL is looked for.
2022-05-17 16:08:38 +02:00
Sascha L. Teichmann
131a7155fa If there are year folders in directory listings, fetch files from the extra level. 2022-05-17 15:58:34 +02:00
Bernhard Reiter
2cfb4b8e49
Fix DNS path check
* Make it dynamic by the domain given for the check.
 * Change reporting text to be more clear about which is the dynamic
   part (in lack of direct access to the path which was checked.)
2022-05-17 15:34:39 +02:00
Bernhard Reiter
29f26e0299
Merge branch 'main' into link-checker 2022-05-17 14:45:01 +02:00
Bernhard Reiter
498aa925a8
Fix typo in html template for checker 2022-05-17 14:41:58 +02:00
Fadi Abbud
f5b7f81aa4 Fix path for locating provider-metadata.json 2022-05-17 12:54:14 +02:00
Sascha L. Teichmann
eaa2620eba Harvest only JSON files. 2022-05-17 11:51:29 +02:00
Bernhard Reiter
292e6ce611
Merge branch 'main' into dev-rolie-validation 2022-05-17 09:19:51 +02:00
Sascha L. Teichmann
3bbd37c441 Implemented links on directory listings checking 2022-05-17 01:22:30 +02:00
Sascha L. Teichmann
32be3602b6 Re-started link checker for directory listings 2022-05-16 18:04:15 +02:00
Bernhard Reiter
d5d48c7d2e
Fix typo in long option of uploader 2022-05-16 16:05:44 +02:00