1
0
Fork 0
mirror of https://github.com/gocsaf/csaf.git synced 2025-12-22 05:40:11 +01:00
Commit graph

131 commits

Author SHA1 Message Date
Sascha L. Teichmann
7aa95c03ca
fix: bring aggregator schema to errata01 (#583) 2024-10-30 11:03:18 +01:00
Marius Goetze
51dc9b5bcb refactor: deduplicate filtering pmd results from security.txt
already done in `loadFromSecurity`
2024-07-15 14:22:15 +02:00
Marius Goetze
a46c286cf4 fix: don't drop error messages from loading provider-metadata.json
previously in case case of trying last resort dns, all other error messages were dropped
2024-07-15 14:22:15 +02:00
Bernhard E. Reiter
e2ad3d3f83
docs: fix licensing info for generated files (#542)
* docs: fix licensing info for generated files

 * change generate_cvss_enums.go to note that the input file is
   relevant for the license.
 * change license and copyright of cvss20enums.go and cvss3enums.go
   to BSD-3-Clause and FIRST.
 * add reuse.software 3.0 compatible files for the schema cvss files.

* Stamp right license into generated files.

---------

Co-authored-by: Sascha L. Teichmann <sascha.teichmann@intevation.de>
2024-06-21 14:02:51 +02:00
Bernhard Herzog
617deb4c17
Merge pull request #530 from oxisto/slog
Added support for structured logging in `csaf_aggregator`
2024-04-25 13:13:11 +02:00
Immanuel Kunz
c704275a38
Merge branch 'csaf-poc:main' into main 2024-04-25 09:42:51 +02:00
Kunz, Immanuel
684770ff2e fix typo, fix linting errors 2024-04-24 17:53:47 +02:00
Kunz, Immanuel
005e661479 add config flag to use enumerate-only 2024-04-23 20:24:18 +02:00
Kunz, Immanuel
457d519990 minor updates to Enumerate method, integrate enumerate in cmd downloader 2024-04-23 19:09:22 +02:00
Kunz, Immanuel
73aef07063 add enumerate function to ProviderMetadataLoader 2024-04-22 17:48:11 +02:00
JanHoefelmeyer
fa96e69dd1 Undo changing license for generated file 2024-04-22 13:15:50 +02:00
JanHoefelmeyer
39a29e39f1 Change Licenses from MIT to Apache 2.0 2024-04-22 13:11:30 +02:00
Christian Banse
e658738b56 Added support for structured logging in csaf_aggretator
This PR adds structured logging for the aggregator service. Currently, only the text handler is used, but I can extend this to use the JSON handler as well. In this case, probably some code that is shared between the aggregator and the downloader would need to be moved to a common package.

I was also wondering, whether this repo is moving to Go 1.21 at the future, since `slog` was introduced in to the standard lib in 1.21. So currently, this still relies on the `x/exp` package.

Fixes #462
2024-04-18 19:58:02 +02:00
Sascha L. Teichmann
03e418182d
Advisories: Time filter download by 'updated' field in ROLIE entries. (#519)
* Use 'updated' field of ROLIE field entries to time filter downloads.

* More suited variable naming
2023-12-04 11:31:14 +01:00
Juan Ariza Toledano
9073a8a282
feat: Add function to find product identification helpers inspecting the tree (#505)
* feat: Add function to find product identification helpers inspecting the tree

Signed-off-by: juan131 <jariza@vmware.com>

* fix: simplify unit tests

Signed-off-by: juan131 <jariza@vmware.com>

* fix: also iterate over relationships

Signed-off-by: juan131 <jariza@vmware.com>

* fix: adapt example to use new library function

Signed-off-by: juan131 <jariza@vmware.com>

* Separate collecting and visiting of the product id helpers.

---------

Signed-off-by: juan131 <jariza@vmware.com>
Co-authored-by: Sascha L. Teichmann <sascha.teichmann@intevation.de>
2023-12-01 15:31:25 +01:00
Sascha L. Teichmann
b457dc872f
Remove usage of slices in enum generator. (#516) 2023-12-01 11:45:09 +01:00
Sascha L. Teichmann
e2ab1903e7 Support legacy security.txt location as fallback. 2023-11-12 10:17:28 +01:00
Sascha L. Teichmann
7f9449a12f Fix pattern matching of purls and document categories. Extract purls from relationships. 2023-11-02 18:23:43 +01:00
cintek
c05a4023ff
Merge branch 'csaf-poc:main' into main 2023-10-12 14:18:42 +02:00
Sascha L. Teichmann
3ba37b41c7 Add AssertFormat flag to schema compiler 2023-09-30 07:49:44 +02:00
Sascha L. Teichmann
7a8cdb6d19
Lift distribution from v2 to v3. (#467)
* v2 -> v3

* Increase version within Makefile

---------

Co-authored-by: JanHoefelmeyer <hoefelmeyer.jan@gmail.com>
2023-09-27 15:46:57 +02:00
Sascha L. Teichmann
20b2bd27b3 Fix typo in comment. 2023-09-13 14:35:22 +02:00
Christoph Klassen
37cdda7c42 dont use pointer for lists of elements 2023-09-13 08:55:28 +02:00
Christoph Klassen
c8f1361c52 added validation for vulnerabilites 2023-09-12 17:26:28 +02:00
Christoph Klassen
b5db976f05 completed validation of product tree 2023-09-12 16:21:00 +02:00
cintek
094fe37026
Merge branch 'main' into cleanup-validation 2023-09-12 15:37:51 +02:00
Christoph Klassen
bdd7f24b31 fix: product tree properties 2023-09-11 21:31:45 +02:00
Sascha L. Teichmann
4da9f67e2e Distribute the validation to the types to reduce the overall complexity. 2023-09-09 21:15:25 +02:00
Christoph Klassen
ed42f193d1 added function to validate ProductTree 2023-09-08 20:04:04 +02:00
Christoph Klassen
f868b13c24 added function to validate document 2023-09-08 16:24:50 +02:00
Christoph Klassen
5a3661e81b use type FileHashValue 2023-09-08 14:52:48 +02:00
Christoph Klassen
dc41aae07f use up-to-date schema for CVSS 3.0 2023-09-07 08:48:34 +02:00
Christoph Klassen
4206c2e4b3 only using enums from CVSS 3.0 2023-09-06 15:51:47 +02:00
Christoph Klassen
b03df5508a added explanation for cvss3VectorStringPattern 2023-09-06 15:44:56 +02:00
Christoph Klassen
f45d273af9 fixed versionPattern 2023-09-05 19:53:48 +02:00
Sascha L. Teichmann
22ef2a925e Unexport patterns 2023-09-05 19:14:57 +02:00
Christoph Klassen
7f36ecb48c added missing types for CVSS2 + changed variable names for more consistency 2023-09-05 16:41:52 +02:00
Christoph Klassen
3acabdf73b reusing TLPLabel and Category from models.go 2023-09-04 17:41:44 +02:00
Christoph Klassen
4fc2fd9bf2 added omitempty for cvss structs 2023-09-04 16:06:47 +02:00
Christoph Klassen
f59a8cc7a9 use generated types 2023-09-04 15:58:28 +02:00
cintek
12d24647c6
Merge pull request #2 from s-l-teichmann/generate-cvss-enums
Add generator for CVSS enums
2023-09-04 15:10:48 +02:00
Sascha L. Teichmann
e821683423 Add generator for CVSS enums 2023-09-02 17:38:12 +02:00
Sascha L. Teichmann
96608a07fe Move defer.Close to right position. 2023-09-02 17:03:46 +02:00
Christoph Klassen
a1ea10baf9 feat: added model for a CSAF advisory 2023-09-01 20:14:18 +02:00
Sascha L. Teichmann
204ddb5a96 Use changes.csv instead of index.txt when using dir bases provider to make date filtering possible. 2023-07-26 03:56:05 +02:00
Sascha L. Teichmann
0ad4ed9e36 Expose logging as field in AdvisoryFileProcessor to shrink constructor signature. 2023-07-26 03:31:00 +02:00
Sascha L. Teichmann
de0599ebe3 Add time interval filtering to downloader. 2023-07-26 03:22:33 +02:00
Sascha L. Teichmann
8032d47b50
Use Set type (#388)
* Use util.Set type.

* Caught another set usage.
2023-07-04 13:00:01 +02:00
JanHoefelmeyer
b61912410a
Empty rolie (#357)
* Create ROLIE feed if summaries are empty

* Formatting, Remove sorting of 0 elements

* Handle minimum entry length error as warning in checker

* Use empty array instead of creating an empty array to reference

* Change schema to allow for empty entry arrays

* Use https://raw.githubusercontent.com/oasis-tcs/csaf/81b2663697958bc5f85d14372712a40028fb8338/csaf_2.0/json_schema/ROLIE_feed_json_schema.json as schema for ROLIE feeds

* Change label name from empty to undefined

* Change default of create_service_document for csaf_provider to true

* Config

* Count entries in csaf-checker, warn if there are none.

* Add Comments to csaf/rolie.go's CountEntries function

* Delete index.txt and changes.csv in aggregator if there are no entries.

* Create an empty ROLIE feed document when setting up folders during create

* nit: set update time stamp in structure init.

* Instantiate label checker only once.

* Ignore domain not having roles.

* provider: Create empty entry section in ROLIE feed.

* Stop check for domain if PMD check fails

* Add missing continue statement

* Report missing ROLIE feed entries in ROLIE feed, not Provider Metadata

* Do not ommit empty entries in ROLIE feeds.

* Fixed error handling problem introduced by faulty merge. Removed unused errStop handling while there.

---------

Co-authored-by: JanHoefelmeyer <hoefelmeyer.jan@gmail.com>
Co-authored-by: Sascha L. Teichmann <sascha.teichmann@intevation.de>
Co-authored-by: JanHoefelmeyer <Jan Höfelmeyer jhoefelmeyer@intevation.de>
2023-06-30 23:34:43 +02:00
Bernhard E. Reiter
cf49c7e414
Fix go.mod and internal dependencies (#371)
* Use a "/v2" in the module path to match the git version tag which
   lead with a 2. Change all mention of the module as dependency
   internally as well.
2023-06-05 10:24:35 +02:00