libpkg add: OSVF parser #2453
libpkg add: OSVF parser #2453
Conversation
illuusio
force-pushed
the
add_osvf_to_libpkg
branch
from
bb1374a to
3b905d2
Compare
|
note there are 2 tests failures on debian: |
libpkg/pkg_osvf.c
Outdated
| unsigned int | ||
| pkg_osvg_get_ecosystem(const char *ecosystem) | ||
| { | ||
| if(strncmp(ecosystem, "AlmaLinux", 8) == 0) |
There was a problem hiding this comment.
it will probably be more maintainable, to have a struct ecomapping [] = { { "AlmaLinux", OSVF_ECOSYSTEM_ALMALINUX} , ... }; and we loop on the all entries. the day we have a new entry it is easier to append
There was a problem hiding this comment.
I'd use a hash table here tbh instead of a loop.
There was a problem hiding this comment.
Also how will we keep this up to date over time as new ones are added?
There was a problem hiding this comment.
I haven't looked what this is used for, but maybe we can just cherrypick the one we are interested in.
There was a problem hiding this comment.
I'll implement full parser for Affected fields as they can be like Ubuntu:Pro:18.04:LTS or Red Hat:rhel_aus:8.4::appstream. For FreeBSD there would be namespaces like: FreeBSD:ports, FreeBSD:kernel:14.3 and FreeBSD:src:14.3?
| unsigned int | ||
| pkg_osvg_get_reference(const char *reference_type) | ||
| { | ||
|
|
There was a problem hiding this comment.
same a mapping struct would be more maintainable
There was a problem hiding this comment.
This one I didn't understand. Is it that you feed struct to that or make new struct for this one?
libpkg/pkg_osvf.c
Outdated
| unsigned int | ||
| pkg_osvg_get_ecosystem(const char *ecosystem) | ||
| { | ||
| if(strncmp(ecosystem, "AlmaLinux", 8) == 0) |
There was a problem hiding this comment.
I'd use a hash table here tbh instead of a loop.
illuusio
force-pushed
the
add_osvf_to_libpkg
branch
from
3b905d2 to
169d6a5
Compare
Open Source Vulnerability format is widely used format to exchage vulnerability information between variable systems. Commit adds OSVF parser to libpkg and also introduces test for making sure that it working correctly. Parser uses schema JSON from https://ossf.github.io/osv-schema/ to make sure that OSVF files are correctly formated. Current parser only supports latest Schema and version. Sponsored by: FreeBSD Foundation
illuusio
force-pushed
the
add_osvf_to_libpkg
branch
from
169d6a5 to
64becb6
Compare
I was using wrong macro here. Correct one for Kyua and atf absolute path is: |
Open Source Vulnerability format is widely used format to exchange vulnerability information between variable systems.
Commit adds OSVF parser to libpkg and also introduces test for making sure that it working correctly.
Parser uses schema JSON from https://ossf.github.io/osv-schema/ to make sure that OSVF files are correctly formatted. Current parser only supports latest Schema and version.