feat(rapidfort): add RapidFort security advisories updater#424
Open
vaibhav-rf wants to merge 11 commits into
Open
feat(rapidfort): add RapidFort security advisories updater#424vaibhav-rf wants to merge 11 commits into
vaibhav-rf wants to merge 11 commits into
Conversation
Change SourcePackageAdvisory advisory map keys and the PackageAdvisory output field from codenames (focal, bookworm) to version numbers (20.04, 12). Update directory paths and testdata accordingly.
…no functional changes
Add redhat to supported OSes and an Identifier field to Event for Red Hat-specific markers (e.g. el9, fc39). Includes test fixture and golden output for redhat/9/curl.
* ci: add zizmor GitHub Actions linter * fix(ci): address zizmor findings in GitHub Actions workflows - Add explicit permissions: contents: read to all jobs - Add persist-credentials: false to read-only checkouts - Add persist-credentials: true to checkouts that require git push - Add cooldown: default-days: 7 to dependabot.yml - Suppress secrets-outside-env via zizmor.yml (no GitHub environments configured)
- Add alpine to supported OSes with source fixture (3.18, 3.19 versions) and golden files covering the multi-version fan-out path - Add test cases for missing package_name and empty advisory map, using wantNoFiles assertions to verify no output is produced - Add supportedOSes per-test-case to keep happy path and edge case scenarios independent - Fix success log to include source/output file counts (consistent with failure log)
|
|
DmitriyLewen
left a comment
DmitriyLewen
left a comment
Contributor
There was a problem hiding this comment.
Hello, thanks for your work!
Do we need this PR?
We use the vuln-list repository for saving as-is advisories to show information and history in a comfortable view.
But you have advisories in your repository, so you can use this repo in trivy-db (like for GitHub, Ruby, etc.)
Regards. Dmitriy
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds a new updater for RapidFort Security Advisories,
enabling
vuln-list-updateto ingest and normalize RapidFort's per-package advisory data into thevuln-listoutput format consumed by
trivy-db.What's added
New package:
rapidfort/types.go– Defines the source and output data models:SourcePackageAdvisory– mirrors the JSON format in thesecurity-advisoriesrepo(
OS/{os}/{package}.json, keyed byversion → cveID → CVEEntry).PackageAdvisory– the normalized output format written tovuln-list, one file per OS version per package.CVEEntryandEvent– per-CVE advisory detail including version ranges, severity, status, andoptional identifiers (e.g.
el9for Red Hat).rapidfort.go– Implements theUpdater:https://github.com/rapidfort/security-advisories.gitinto the local cache.GITHUB_TOKENinto the clone URL automatically when set, supporting private/auth-gated reposin CI without SSH key configuration.
ubuntu,alpine,redhatby default).vuln-list/rapidfort/{os}/{version}/{package}.json.package_namefields per OS withoutfailing the overall run.
rapidfort_test.go– Unit tests covering:package_name, empty advisory maps.WithRepoDiroption to bypass git clone in tests.Registration in
main.go"rapidfort"as a named target, wiring it torapidfort.NewUpdater().