SystemSh0cker/gocsaf
1
0
Fork 0
mirror of https://github.com/gocsaf/csaf.git synced 2025-12-22 05:40:11 +01:00
Code Issues Releases Activity Actions
Tools to download or provide CSAF2 (Common Security Advisory Framework) documents.
967 commits 13 branches 34 tags 8.5 MiB
Find a file
Christian Banse e658738b56 Added support for structured logging in csaf_aggretator 
This PR adds structured logging for the aggregator service. Currently, only the text handler is used, but I can extend this to use the JSON handler as well. In this case, probably some code that is shared between the aggregator and the downloader would need to be moved to a common package.

I was also wondering, whether this repo is moving to Go 1.21 at the future, since `slog` was introduced in to the standard lib in 1.21. So currently, this still relies on the `x/exp` package.

Fixes #462
2024-04-18 19:58:02 +02:00
.github/workflows Older version (#513) 2023-12-07 16:12:26 +01:00
cmd Added support for structured logging in csaf_aggretator 2024-04-18 19:58:02 +02:00
csaf Added support for structured logging in csaf_aggretator 2024-04-18 19:58:02 +02:00
docs docs: fix minor typo in test-keys/Readme.md (#525) 2024-02-23 14:48:39 +01:00
examples feat: Add function to find product identification helpers inspecting the tree (#505) 2023-12-01 15:31:25 +01:00
internal Added support for structured logging in csaf_aggretator 2024-04-18 19:58:02 +02:00
LICENSES Improve joining of url paths in some situations 2022-07-18 17:41:52 +02:00
util Use Intevation's JSONPath fork (#490) 2023-11-02 10:41:24 +01:00
.gitignore refactor: add a .gitignore and include build directory 2022-09-24 19:21:56 +02:00
3rdpartylicenses.md Add support for remote validation services. (#185) 2022-06-21 14:47:06 +02:00
go.mod Added support for structured logging in csaf_aggretator 2024-04-18 19:58:02 +02:00
go.sum Added support for structured logging in csaf_aggretator 2024-04-18 19:58:02 +02:00
Makefile feat: add macos binaries archive to Makefile 2023-10-13 17:52:14 +02:00
README.md docs: improve link to CSAF standard documents 2024-02-27 09:44:41 +01:00

README.md

csaf_distribution

An implementation of a CSAF 2.0 Spec (Errata) trusted provider, checker, aggregator and downloader. Includes an uploader command line tool for the trusted provider.

Tools for users

csaf_downloader

is a tool for downloading advisories from a provider. Can be used for automated forwarding of CSAF documents.

csaf_validator

is a tool to validate local advisories files against the JSON Schema and an optional remote validator.

Tools for advisory providers

csaf_provider

is an implementation of the role CSAF Trusted Provider, also offering a simple HTTPS based management service.

csaf_uploader

is a command line tool to upload CSAF documents to the csaf_provider.

csaf_checker

is a tool for testing a CSAF Trusted Provider according to Section 7 of the CSAF standard.

csaf_aggregator

is a CSAF Aggregator, to list or mirror providers.

Other stuff

examples

are small examples of how to use github.com/csaf-poc/csaf_distribution as an API. Currently this is a work in progress, as usage of this repository as a library to access is not officially supported, e.g. see https://github.com/csaf-poc/csaf_distribution/issues/367 .

Setup

Binaries for the server side are only available and tested for GNU/Linux-Systems, e.g. Ubuntu LTS. They are likely to run on similar systems when build from sources.

The windows binary package only includes csaf_downloader, csaf_validator, csaf_checker and csaf_uploader.

The MacOS binary archives come with the same set of client tools and are community supported. Which means: while they are expected to run fine, they are not at the same level of testing and maintenance as the Windows and GNU/Linux binaries.

Prebuild binaries

Download the binaries from the most recent release assets on Github.

Build from sources

  • A recent version of Go (1.20+) should be installed. Go installation

  • Clone the repository git clone https://github.com/csaf-poc/csaf_distribution.git

  • Build Go components Makefile supplies the following targets:

    • Build for GNU/Linux system: make build_linux
    • Build for Windows system (cross build): make build_win
    • Build for macOS system on Intel Processor (AMD64) (cross build): make build_mac_amd64
    • Build for macOS system on Apple Silicon (ARM64) (cross build): make build_mac_arm64
    • Build For GNU/Linux, macOS and Windows: make build
    • Build from a specific git tag by passing the intended tag to the BUILDTAG variable. E.g. make BUILDTAG=v1.0.0 build or make BUILDTAG=1 build_linux. The special value 1 means checking out the highest git tag for the build.
    • Remove the generated binaries und their directories: make mostlyclean

Binaries will be placed in directories named like bin-linux-amd64/ and bin-windows-amd64/.

Setup (Trusted Provider)

Development

For further details of the development process consult our development page.

License

  • csaf_distribution is licensed as Free Software under MIT License.

  • See the specific source files for details, the license itself can be found in the directory LICENSES/.

  • Contains third party Free Software components under licenses that to our best knowledge are compatible at time of adding the dependency, 3rdpartylicenses.md has the details.

  • Check the source file of each schema under /csaf/schema/ to see the source and license of each one.