SystemSh0cker/gocsaf
1
0
Fork 0
mirror of https://github.com/gocsaf/csaf.git synced 2025-12-22 05:40:11 +01:00
Code Issues Releases Activity Actions
Tools to download or provide CSAF2 (Common Security Advisory Framework) documents.
751 commits 13 branches 34 tags 8.5 MiB
Find a file
Exact
JanHoefelmeyer de27a668d1
Complete requirement 4 (ROLIE) (#391) 
* Create dummy structure to uniquely identify each advisory

* Remove dummy values, remove unused variable for now

* Formatting

* Add Evaluation of whether a white Advisory is access protected and add it to the respective slice, implement functionality

* Initialize p.whiteAdvisories before using it, stop sorting if no Client was used

* Ammend rules to include requirement 4, warning instead of error if white advisory is found protected, use badWhitePermissions.use()

* Formatting

* Fix typo: avaible -> available

* Improve check on whether building identifier failed

* Move extracting of tlp labels and related functions from processor to roliecheck

* Create Labelchecker and check access of white advisories regardless of whether ROLIE feeds exist. Only check Ranks if ROLIE feeds are used

* Formatting

* Do not use label checker as a pointer.

* Rename label checker

* Add XXX to questionable code.

* Simplify checking white advisories.

* Improve error message if no checks for accessibility of white advisories were done

* Extract TLP label directly without extractTLP function, consistent plural in error message

* Add comments and check type assertion in tlp label extraction.

* Move check for white advisories to label checker.

* Improve methods naming an comments.

* Address a few review questions.

* Move functionality of checkProtection fully into evaluateTLP

* Add comments and warn only if we are in a white feed or in a dirlisting.

---------

Co-authored-by: JanHoefelmeyer <Jan Höfelmeyer jhoefelmeyer@intevation.de>
Co-authored-by: JanHoefelmeyer <hoefelmeyer.jan@gmail.com>
Co-authored-by: Sascha L. Teichmann <sascha.teichmann@intevation.de>
2023-07-13 22:22:11 +02:00
.github/workflows Add concurrent downloads to downloader. (#363) 2023-05-02 10:10:12 +02:00
cmd Complete requirement 4 (ROLIE) (#391) 2023-07-13 22:22:11 +02:00
csaf Use Set type (#388) 2023-07-04 13:00:01 +02:00
docs Empty rolie (#357) 2023-06-30 23:34:43 +02:00
LICENSES Improve joining of url paths in some situations 2022-07-18 17:41:52 +02:00
util Improve error message if filename does not match document/tracking/id and let it be reported by the proper reporter (#382) 2023-06-30 23:36:54 +02:00
.gitignore refactor: add a .gitignore and include build directory 2022-09-24 19:21:56 +02:00
3rdpartylicenses.md Add support for remote validation services. (#185) 2022-06-21 14:47:06 +02:00
go.mod Update third party libraries. (#389) 2023-07-04 12:59:29 +02:00
go.sum Update third party libraries. (#389) 2023-07-04 12:59:29 +02:00
Makefile Burn v2 version into binaries. 2023-06-20 12:52:49 +02:00
README.md We need at least Go 1.20 2023-06-05 10:26:31 +02:00

README.md

csaf_distribution

An implementation of a CSAF 2.0 trusted provider, checker, aggregator and downloader. Includes an uploader command line tool for the trusted provider.

csaf_provider

is an implementation of the role CSAF Trusted Provider, also offering a simple HTTPS based management service.

csaf_uploader

is a command line tool that uploads CSAF documents to the csaf_provider.

csaf_aggregator

is an implementation of the role CSAF Aggregator.

csaf_checker

is a tool for testing a CSAF Trusted Provider according to Section 7 of the CSAF standard. Does check requirements without considering the indicated role yet.

csaf_downloader

is a tool for downloading advisories from a provider.

csaf_validator

is a tool to validate local advisories files against the JSON Schema and an optional remote validator.

Setup

Note that binaries for the server side are only available and tested for GNU/Linux-Systems, e.g. Ubuntu LTS. They are likely to run on similar systems when build from sources.

The windows binary package only includes csaf_downloader, csaf_validator, csaf_checker and csaf_uploader.

Prebuild binaries

Download the binaries from the most recent release assets on Github.

Build from sources

  • A recent version of Go (1.20+) should be installed. Go installation

  • Clone the repository git clone https://github.com/csaf-poc/csaf_distribution.git

  • Build Go components Makefile supplies the following targets:

    • Build For GNU/Linux System: make build_linux
    • Build For Windows System (cross build): make build_win
    • Build For both linux and windows: make build
    • Build from a specific github tag by passing the intended tag to the BUILDTAG variable. E.g. make BUILDTAG=v1.0.0 build or make BUILDTAG=1 build_linux. The special value 1 means checking out the highest github tag for the build.
    • Remove the generated binaries und their directories: make mostlyclean

Binaries will be placed in directories named like bin-linux-amd64/ and bin-windows-amd64/.

Setup (Trusted Provider)

License

  • csaf_distribution is licensed as Free Software under MIT License.

  • See the specific source files for details, the license itself can be found in the directory LICENSES/.

  • Contains third party Free Software components under licenses that to our best knowledge are compatible at time of adding the dependency, 3rdpartylicenses.md has the details.

  • Check the source file of each schema under /csaf/schema/ to see the source and license of each one.