SystemSh0cker/gocsaf
1
0
Fork 0
mirror of https://github.com/gocsaf/csaf.git synced 2025-12-22 11:55:40 +01:00
Code Issues Releases Activity Actions
Tools to download or provide CSAF2 (Common Security Advisory Framework) documents.
439 commits 13 branches 34 tags 8.5 MiB
Find a file
JanHoefelmeyer 46f79a9e24
Bailout unknown config (#216) 
* provider now checks for undecoded config entries and returns an error if any are found

* Specific error message now in server logs, more general message for user

* Changes spaces to tabs for formatting consistency

* Further formatting

* Improved handling of undecoded TOML fields in config.

* aggregator now checks for not decoded config options

Co-authored-by: Jan Höfelmeyer <Jan Höfelmeyer jhoefelmeyer@intevation.de>
Co-authored-by: Sascha L. Teichmann <sascha.teichmann@intevation.de>
2022-07-12 14:07:12 +02:00
.github/workflows Add CSAF downloader 2022-06-23 14:14:44 +02:00
cmd Bailout unknown config (#216) 2022-07-12 14:07:12 +02:00
csaf write dynamic categories into feed categories document. 2022-06-30 11:58:36 +02:00
docs Rewrote confusing config option explanations in csaf_provider (#213) 2022-07-11 12:32:48 +02:00
LICENSES Add MIT licensing text 2021-12-10 09:07:35 +01:00
util write dynamic categories into feed categories document. 2022-06-30 11:58:36 +02:00
3rdpartylicenses.md Add support for remote validation services. (#185) 2022-06-21 14:47:06 +02:00
go.mod Add support for remote validation services. (#185) 2022-06-21 14:47:06 +02:00
go.sum Add support for remote validation services. (#185) 2022-06-21 14:47:06 +02:00
Makefile Add CSAF downloader 2022-06-23 14:14:44 +02:00
README.md Add CSAF downloader 2022-06-23 14:14:44 +02:00

README.md

csaf_distribution

An implementation of a CSAF 2.0 trusted provider, checker, aggregator and downloader. Includes an uploader command line tool for the trusted provider.

Status: Beta (ready for more testing, but known shortcomings see issues)

csaf_provider

is an implementation of the role CSAF Trusted Provider, also offering a simple HTTPS based management service.

csaf_uploader

is a command line tool that uploads CSAF documents to the csaf_provider.

csaf_aggregator

is an implementation of the role CSAF Aggregator.

csaf_checker

is a tool for testing a CSAF Trusted Provider according to Section 7 of the CSAF standard.

csaf_downloader

is a tool for downloading advisories from a provider.

Setup

Note that the server side is only tested and the binaries available for GNU/Linux-Systems, e.g. Ubuntu LTS. It is likely to run on similar systems when build from sources.

The windows binaries only include csaf_uploader and csaf_checker.

Prebuild binaries

Download the binaries (from the most recent release assets on Github).

Build from sources

  • A recent version of Go (1.17+) should be installed. Go installation

  • Clone the repository git clone https://github.com/csaf-poc/csaf_distribution.git

  • Build Go components Makefile supplies the following targets:

    • Build For GNU/Linux System: make build_linux
    • Build For Windows System (cross build): make build_win
    • Build For both linux and windows: make build
    • Build from a specific github tag by passing the intended tag to the BUILDTAG variable. E.g. make BUILDTAG=v1.0.0 build or make BUILDTAG=1 build_linux. The special value 1 means checking out the highest github tag for the build.
    • Remove the generated binaries und their directories: make mostlyclean

Binaries will be placed in directories named like bin-linux-amd64/ and bin-windows-amd64/.

Setup (Trusted Provider)

License

  • csaf_distribution is licensed as Free Software under MIT License.

  • See the specific source files for details, the license itself can be found in the directory LICENSES/.

  • Contains third party Free Software components under licenses that to our best knowledge are compatible at time of adding the dependency, 3rdpartylicenses.md has the details.

  • Check the source file of each schema under /csaf/schema/ to see the source and license of each one.