41 releases (7 breaking)

new 0.7.5 May 19, 2024
0.6.0 Apr 26, 2024
0.6.0-alpha.8 Feb 23, 2024
0.5.4 Oct 27, 2023
0.1.4 Jul 6, 2023

#242 in Data structures

Download history 91/week @ 2024-01-29 102/week @ 2024-02-05 134/week @ 2024-02-12 195/week @ 2024-02-19 200/week @ 2024-02-26 269/week @ 2024-03-04 139/week @ 2024-03-11 67/week @ 2024-03-18 10/week @ 2024-03-25 117/week @ 2024-04-01 52/week @ 2024-04-08 211/week @ 2024-04-15 631/week @ 2024-04-22 213/week @ 2024-04-29 19/week @ 2024-05-06 673/week @ 2024-05-13

1,539 downloads per month
Used in 3 crates (2 directly)

Apache-2.0 and LGPL-2.0-or-later

3.5MB
48K SLoC

JavaScript 43K SLoC // 0.1% comments Rust 6K SLoC // 0.0% comments

CSAF Walker

crates.io docs.rs GitHub release (latest SemVer) CI

"Walk" CSAF data from a remote server, allowing one to work with the data.

In addition, this repository also has a tool for working with SBOM data. Most of the options explained are valid for both SBOM and CSAF.

From the command line

There's a command line tool, which can be used right away.

Installation

Download a ready-to-run binary from the GitHub release page: https://github.com/ctron/csaf-walker/releases

You can also use cargo binstall to install such a binary:

cargo binstall csaf-cli
cargo binstall sbom-cli

Or compile it yourself, using plain cargo install:

cargo install csaf-cli
cargo install sbom-cli

Usage

You can download all documents by providing a domain of the CSAF trusted provider:

mkdir out
csaf sync -3 -v -d out/ redhat.com

It is also possible to only download files, skipping the validation step (which can be done later using an already downloaded copy):

mkdir out
csaf download -3 -v -d out/ redhat.com

[!NOTE] In cases where data is signed with a GPG v3 signature, you can use the -3 flag, which considers this still valid.

An alternative is to use the --policy-date argument, and provide a manual policy date. Also see: https://docs.sequoia-pgp.org/sequoia_openpgp/policy/struct.StandardPolicy.html.

Differential sync

By default, timestamps reported by the HTTP server will be applied to the downloaded files. When re-running, the changes.csv file will be used as a source to discover when a file was changed. If a file is already present and has a newer modification timestamp in the changes.csv file, then it will be downloaded again. Otherwise, it will be skipped.

Using the --since option, it is possible to provide a start timestamp, which will skip all changes reported before this timestamp, and force all changes after this timestamp (independent of the file local file timestamp) to be re-synced.

Using the --since-file option, it is possible to automate the "since" value, by initially loading the "since" value from a file, and storing it into a file at the end of a successful run. The timestamp stored will be the timestamp, when the application started processing.

If both --since and --since-file are provided, then the "since file" will be used first, and the "since" value will act as a fallback if the file is not present.

Sending data

Instead of storing, it is also possible to send data to a remote instance (using the Vexination or Bombastic API).

csaf send -3 redhat.com http://localhost:8083

Of course, it is also possible to use the filesystem as a source:

csaf send -3 file:out/ http://localhost:8083

As a library

Using the crate csaf-walker, this can also be used as a library:

use anyhow::Result;
use url::Url;
use csaf_walker::source::HttpSource;
use csaf_walker::walker::Walker;
use csaf_walker::retrieve::RetrievingVisitor;
use csaf_walker::validation::{ValidatedAdvisory, ValidationError, ValidationVisitor};
use walker_common::fetcher::Fetcher;

async fn walk() -> Result<()> {
    let fetcher = Fetcher::new(Default::default()).await?;
    let metadata = MetadataRetriever::new("redhat.com");
    let source = HttpSource::new(metadata, fetcher, Default::default());

    Walker::new(source.clone())
        .walk(RetrievingVisitor::new(
            source.clone(),
            ValidationVisitor::new(
                move |advisory: Result<ValidatedAdvisory, ValidationError>| async move {
                    log::info!("Found advisory: {advisory:?}");
                    Ok::<_, anyhow::Error>(())
                },
            )
        ))
        .await?;

    Ok(())
}

Dependencies

~36–69MB
~1M SLoC