1
0
Fork 0
mirror of https://github.com/gocsaf/csaf.git synced 2025-12-22 11:55:40 +01:00
Commit graph

120 commits

Author SHA1 Message Date
JanHoefelmeyer
ed26e8e41d Add Tests for Requirements 4 and 5 2023-06-21 15:35:00 +02:00
Sascha L. Teichmann
421a05d421 Ignore domain not having roles. 2023-06-19 13:49:31 +02:00
JanHoefelmeyer
8d269ce106 No longer require optional distribution section in advisory to extract TLP label 2023-06-16 14:10:54 +02:00
Sascha L. Teichmann
71a3c3a13b Unify camel case spelling of message tracking. 2023-06-15 14:18:46 +02:00
JanHoefelmeyer
d91af558ce Add ROLIE category document check for existence 2023-06-15 11:05:37 +02:00
JanHoefelmeyer
380ccfdf5a Add fetch of service category document from pmd url 2023-06-14 15:18:48 +02:00
JanHoefelmeyer
87dbb5674b Add badROLIEservice to processor 2023-06-14 09:50:12 +02:00
Sascha L. Teichmann
7501c60bf4 Implement rule depending error check. 2023-06-13 13:28:01 +02:00
Sascha L. Teichmann
c7453a6448 Be more precise with conditional rules. 2023-06-13 12:25:19 +02:00
JanHoefelmeyer
7eae607810
Merge pull request #370 from csaf-poc/fix-pmd-crash
Fix pmd crash
2023-06-09 13:17:42 +02:00
Sascha L. Teichmann
55540a32e0
Simplified requirement 15 (#369)
* Add badROLIEfeed as Topic Message

* Use badROLIEfeed to guarantee existant TLP labels White, Green or unlabeled. (Test not implemented)

* syntax

* Formatting

* Add Tlp check, completion struct

* Add mismatch to completion, add function checkCompletion to fill mismatch and also give an error if invalid tlp levels have been used

* formatting

* Add function to remove incomplete csaf feeds from list of complete csaf feeds for a given tlp level

* Add checkSummary function that checks whether a given feed would qualify as summary feed between all currently checked feeds

* Add completed check of tlp levels

* Add checks for correct hashes and signatures in ROLIE feed

* formatting

* Add rolieFeedReporter functionality

* fix typo

* Add todo, add return values to functions

* Switch error, ... return value so error returns last

* Fix typo

* Remove hash/sig checks that don't work, improve ROLIE message

* Add handling for advisories without tlp level

* Formatting

* Clean up rolie checks.

* Started with simplifying rolie checking

* Every ROLIE with data should have a summary.

* Clean up ROLIE feed label checker.

* if no TLP level can be extracted, return Unlabeled, not WHITE

* Add handling of advisories whose tlp exists, but has no label

* Also check TLP Red for completeness

* Only remove advisory from remain when it has exactly the right tlp color.

* Fix import in new rolie feed checker.

* Update comment to reflect current functionality

* Accept advisory of lesser tlp color in feed as completing.

* Collect advisory labels from advisories.

* Clarify that if no summary feed was found, it may exist but be either not listed or not accessible.

* Do not clone advisory lookup before.

* Move rolie check code to respective file.

---------

Co-authored-by: JanHoefelmeyer <Jan Höfelmeyer jhoefelmeyer@intevation.de>
Co-authored-by: JanHoefelmeyer <hoefelmeyer.jan@gmail.com>
2023-06-08 18:16:56 +02:00
Bernhard E. Reiter
cf49c7e414
Fix go.mod and internal dependencies (#371)
* Use a "/v2" in the module path to match the git version tag which
   lead with a 2. Change all mention of the module as dependency
   internally as well.
2023-06-05 10:24:35 +02:00
JanHoefelmeyer
9d1000d773 Slightly improve phrasing 2023-06-02 13:32:55 +02:00
JanHoefelmeyer
3eced62af6 Stop checking a Provider Metadata if it could not be parsed 2023-06-02 13:30:28 +02:00
Bernhard Herzog
02d476360b
Merge pull request #366 from csaf-poc/cleanup_provider_metadata_loading
Prepare infrastructure for role based reporting
2023-05-16 17:53:18 +02:00
JanHoefelmeyer
4461bd6892
Merge pull request #365 from csaf-poc/filename-id
Check that filename matches /document/tracking/id
2023-05-16 08:50:48 +02:00
Sascha L. Teichmann
068a94235c Add PMD loading errors to bad provider metadata report. 2023-05-15 14:01:27 +02:00
Sascha L. Teichmann
bd7831d7c3 Build reporters from role 2023-05-15 12:12:42 +02:00
Sascha L. Teichmann
2e968b197d Removed old pmd loader. 2023-05-15 08:47:18 +02:00
Sascha L. Teichmann
c4e9637f2b Re-use eval of processor. 2023-05-11 15:25:31 +02:00
Sascha L. Teichmann
c263391821
Be more verbose in case of signature check failures (#361)
* Simplify handling of signature keys. Be more verbose in case of signature check failures.

* Fixed check for having no OpenPGP loaded
2023-05-05 15:02:53 +02:00
Bernhard Herzog
c37b127d82 Check that filename matches ID in csaf_checker 2023-04-25 19:24:59 +02:00
Sascha L. Teichmann
0c2768b711 Fix header client. Simplify code. 2023-03-24 13:40:31 +01:00
JanHoefelmeyer
8f87273837
Remote validator output (#347)
* The validator is now able to print the details of the remote validations.
---------

Co-authored-by: JanHoefelmeyer <hoefelmeyer.jan@gmail.com>
Co-authored-by: JanHoefelmeyer <Jan Höfelmeyer jhoefelmeyer@intevation.de>
Co-authored-by: Sascha L. Teichmann <sascha.teichmann@intevation.de>
2023-03-15 11:02:06 +01:00
JanHoefelmeyer
80195a24c3 improve phrasing in checker 'has not a' 2023-02-03 16:21:15 +01:00
Sascha L. Teichmann
ffb29f5ba4 Replace 'confirming filename' with 'conforming filename' 2023-02-03 16:21:15 +01:00
Sascha L. Teichmann
8425644886 Add new requirement sections 1 and 2 to report 2023-02-02 17:17:50 +01:00
Sascha L. Teichmann
cbd9dead37 Fix small typo in reporting wromg content type 2023-02-02 00:54:39 +01:00
Sascha L. Teichmann
6430712dad Warn in checker and downloader if advisories are delivered as none 'application/json' 2023-02-02 00:54:39 +01:00
tschmidtb51
0383e951a8
Merge branch 'main' into checker-validator 2023-01-27 17:58:37 +01:00
Sascha L. Teichmann
51fba46893 Add extra http header support to downloader and checker. 2023-01-26 22:09:38 +01:00
Sascha L. Teichmann
e004939abf Implement remote validation in checker. 2023-01-25 10:27:44 +01:00
Sascha L. Teichmann
c4b70d20cd Demand Go 1.19 in go.mod. Replaced interface{} with any 2023-01-19 16:45:26 +01:00
tschmidtb51
6b9ecead89 refactor: remove temporary solution joinUrlPath and use joinPath from Go 1.19.1 net/url 2022-09-24 18:53:03 +02:00
Sascha L. Teichmann
70b4e18b58
Treat invalid PMDs as error and stop processing if needed
*  Improve how PMD validation result is used when searching for a valid PMD.
   We now stop if no PMD can be validated against the json schema.
2022-08-26 16:53:18 +02:00
JanHoefelmeyer
3bb8ea0019
Improve checker regarding PMD location problems
* Change checking to test for Security, wellknown and DNS requirement at once and only throws error if all three fail.
* Use security.txt parser from csaf/util to extract provider url.
* Improve code comments and messages for the reports.

Co-authored-by: Jan Höfelmeyer <Jan Höfelmeyer jhoefelmeyer@intevation.de>
Co-authored-by: Sascha L. Teichmann <sascha.teichmann@intevation.de>
Co-authored-by: Bernhard Reiter <bernhard@intevation.de>
2022-08-26 13:31:56 +02:00
Sascha L. Teichmann
29d7dd1223 Make URLs absolute in integrity check 2022-08-01 14:46:57 +02:00
Sascha L. Teichmann
fad70b4dd5 Merge branch 'main' into directory-url 2022-08-01 13:20:04 +02:00
JanHoefelmeyer
9890a417b4
Merge pull request #268 from csaf-poc/no-rolie-index-changes-listings
There are no index.txt, changes.csv in ROLIE dists.
2022-08-01 13:18:36 +02:00
JanHoefelmeyer
141fbe21ca
Find missing (#269)
Solves #160 

* Implements check on whether index.txt/changes.csv and directory listings exist. Also fixes minor grammatical mistakes

* Adds missing else to prevent defaulting to missing-error handling even if another error was found

* Removes comment

* test whether changes.csv or index.txt is empty

* Fixed type mismatching, undeclared variable

* Fixes typo in variable

* Fixes another typo in variable

* Fixes formatting error

* Removed reminder comments

* Fixes formatting errors

* Added check for missing directories

* Moved empty dirlistcheck to the right position

* fixes typo

* fixes typo

* Add info if files are found

* Cleans up code

* simplified check for empty changes.csv and index.txt

Co-authored-by: Jan Höfelmeyer <Jan Höfelmeyer jhoefelmeyer@intevation.de>
Co-authored-by: Sascha L. Teichmann <sascha.teichmann@intevation.de>
2022-08-01 13:17:35 +02:00
Sascha L. Teichmann
050e225d07 Fix type assertions from directory_url expression result 2022-08-01 13:00:10 +02:00
Sascha L. Teichmann
ada8070c63 There are no index.txt, changes.csv in ROLIE dists. 2022-08-01 07:20:52 +02:00
Sascha L. Teichmann
dce3d1f4a7 load advisories via directory_urls 2022-08-01 06:46:05 +02:00
Sascha L. Teichmann
1241429d19
Load client certs early to detect misconfiguration
* Move loading of client certificate into the TLS handling code
   to an earlier position.
2022-07-26 18:00:07 +02:00
Sascha L. Teichmann
d1855a9c30
Improve checks and messages for bad entries in files
* Ignore bad URLs in index.txt, improve messages.

resolve #158
2022-07-21 17:11:46 +02:00
Sascha L. Teichmann
3a43ca5630 Merge branch 'main' into publisher-in-report 2022-07-20 11:35:17 +02:00
Fadi Abbud
6a87157184
Merge pull request #235 from csaf-poc/bad-dirs-only-once
Only report bad directories in listing check only once.
2022-07-19 12:51:29 +02:00
Sascha L. Teichmann
649b5c904b Added publisher and role to domain report. 2022-07-18 22:44:34 +02:00
Sascha L. Teichmann
efa233f2ce Merge branch 'main' into quick-ckeck 2022-07-18 20:08:02 +02:00
Sascha L. Teichmann
86a015d6bf
Correct field order in changes.csv (#228) 2022-07-18 18:37:55 +02:00