SystemSh0cker/gocsaf
1
0
Fork 0
mirror of https://github.com/gocsaf/csaf.git synced 2025-12-22 11:55:40 +01:00
Code Issues Releases Activity Actions
gocsaf/docs/csaf_provider.md
Sascha L. Teichmann 20f5937240
Only create/update index.txt, changes.csv, security.txt when configured. (#210) 
* Change default to not write index.txt, changes.csv and security.txt 
  (for provider and aggregator)
* Add config file options to reenable writing.
2022-07-05 16:44:45 +02:00

2.9 KiB
Raw Blame History

csaf_provider implements the CGI interface for webservers and reads its configuration from a TOML file. The setup docs explain how to wire this up with nginx and where the config file lives.

Provider options

Following options are supported in the config file:

  • password: Authentication password for accessing the CSAF provider.
  • openpgp_public_key: The public OpenPGP key. Default: /ust/lib/csaf/openpgp_public.asc
  • openpgp_private_key: The private OpenPGP key. Default: /ust/lib/csaf/openpgp_private.asc
  • folder: Specify the root folder. Default: /var/www/.
  • web: Specify the web folder. Default: /var/www/html.
  • upload_signature: Send signature with the request, an additional input-field in the web interface will be shown to let user enter an ascii armored signature. Default: false.
  • canonical_url_prefix: start of the URL where contents shall be accessible from the internet. Default: https://$SERVER_NAME.
  • no_passphrase: Let user send password with the request, if set to true the input-field in the web interface will be disappeared. Default: false.
  • no_validation: Validate the uploaded CSAF document against the JSON schema. Default: false.
  • no_web_ui: Disable the web interface. Default: false.
  • dynamic_provider_metadata: Take the publisher from the CSAF document. Default: false.
  • upload_limit: Set the upload limit size of a file in bytes. Default: 52428800 (aka 50 MiB).
  • issuer: The issuer of the CA, which if set, restricts the writing permission and the accessing to the web-interface to only the client certificates signed with this CA.
  • write_indices: Write/update index.txt and changes.csv. Default: false
  • write_security: Write CSAF: entry into security.txt: Default: false
  • tlps: Set the allowed TLP comming with the upload request (one or more of "csaf", "white", "amber", "green", "red"). The "csaf" selection lets the provider takes the value from the CSAF document. These affects the list items in the web interface. Default: ["csaf", "white", "amber", "green", "red"].
  • provider_metadata: Configure the provider metadata.
  • provider_metadata.list_on_CSAF_aggregators: List on aggregators
  • provider_metadata.mirror_on_CSAF_aggregators: Mirror on aggregators
  • remote_validator: Use a remote validator service. Not used by default. { "url" = "http://localhost:3000", "presets" = ["mandatory"], "cache" = "/var/lib/csaf/validations.db" }
  • provider_metadata.publisher: Set the publisher. Default:
[provider_metadata.publisher]
category = "vendor"
name = "Example Company"
namespace = "https://example.com"
issuing_authority = "We at Example Company are responsible for publishing and maintaining Product Y."
contact_details = "Example Company can be reached at contact_us@example.com, or via our website at https://www.example.com/contact."