* Change nginx config to return 403 on unauthorized access to
the non-white TLP locations. We cannot hide the existence anyway,
as it is listed in the provider-metadata.json, even when restricted.
* Change checking to use client certs and verbose for html
as this is what can be displayed on a webbrowser.
* Rename the json result file to indicate why the result will differ
without using the access of the client certificate.
* Modify script to call checker twice with difference options,
including one with json and --verbose.
* Add json result as build artifact to be uploaded.
* Move the config variables which could be specified as tables in TOML
to the bottom of the documentation, to avoid that a regular toplevel
variable is used below them (which would be wrong in TOML).
* Be more specific about the value of the `upload_limit`.
* Do chgrp and chmod not recursively as we have just created the
directory and if taken as example the recursive chmod with the
s bit will produce unwanted results on files.
* Change comment to better indicate setting in nginx example conf
which serves the TLP != white locations of the prodiver.
We do advertise them in the provider-metadata.json, but we still
want to use 404 to not reveal more about the directory contents.
* Improve aggregator setup docs
* Add hints how to serve the aggregator output using nginx.
* Add hint that the permission of the aggregator config file should be
restricted.
* Add a setuid bit to the aggregator integration test script
to easy manual serving.
* Wording
Co-authored-by: Sascha L. Teichmann <sascha.teichmann@intevation.de>
* Adjust provider and aggregator to copy the used openpgp pubkey into a locally
provided directory `openpgp` beside the `prodiver-metadata.json`.
This more robust and self-reliant than using a public pubkey server,
which is the reason why the CSAF 2.0 csd02 mentions it as example in
"7.1.20 Requirement 20: Public OpenPGP Key".
* Improve aggregator by removing a typo `aggreator` from one written paths.
(Done with this change as it also affects the openpgp/ paths writing.)
solve #85
* Implement a logging client and activate it using verbose parameter or option
in checker and aggregator.
Co-authored-by: Sascha L. Teichmann <sascha.teichmann@intevation.de>
* Add general hints that this example only shows how the components
work together and that a GNU/Linux admin should be consulted for
a secure setup.
* Adjust the scripts that setup a testing instance to use better
permissions as good example.
* Add a section about security considerations.
* Add short description for each component in the main README
* Move more Info in separated files.
* Add hint that csaf_provider offers a service interface.
* Explain why windows only has uploader and checker.
Co-authored-by: Bernhard Reiter <bernhard@intevation.de>
* Factor JSON evaluation and construction base URLs out of of checker.
* Move json path matching to util.
* Add csaf_aggregator (as additional command)
* Improve itest workflow to checkout the branch where it is running on.
resolve #105
resolve #72
Co-authored-by: tschmidtb51 <65305130+tschmidtb51@users.noreply.github.com>
Co-authored-by: Bernhard Reiter <bernhard@intevation.de>
Co-authored-by: Fadi Abbud <fadi.abbud@intevation.de>
* Remove `let` from the script as it will return 1 (signalling an error) on the
first iteration, which will stop the script when in `set -e` mode.
It also is unnecessary, as the increment can be done at the place of
usage directly.
* Added a "remainder aka modulo" division, otherwise there will be no
TLP option set, once we run out of the four entries in the TLSs
list.
* (Style) remove superfluous semicolons.
