108 Commits (master)

Author	SHA1	Message	Date
Eric Sim	6617f560cc	database: Rename affected type to feature type (for Amazon Linux updater)	5 years ago
Eric Sim	adde75975f	Fix style issues	5 years ago
Eric Sim	684ae2be1d	Refactoring (minor)	5 years ago
Eric Sim	8e98ee878a	Add 2xx checks for mirror.list and repomd.xml	5 years ago
Eric Sim	803cf4a29e	gofmt	5 years ago
Eric Sim	8fb9097dbd	Add updaters for Amazon Linux 2018.03 and Amazon Linux 2 ... We get vulnerabilities from ALAS (Amazon Linux Security Advisories) data, which can be found in updateinfo.xml from the repos.	5 years ago
Chris Northwood	a3a37072b5	tarutil: convert all filename specs to regexps ... This removes the previous behaviour from tarutil to do simple prefix matching. All places where the previous prefix-based matches were specified have been updated to use a regexp instead, maintaining previous behaviour.	5 years ago
Ales Raszka	a8a91379d9	Add test for potential namespace ... Test verifies that potential namespace is stored in database and it can be loaded back to structure. The commit also fixes few typos and bugs.	5 years ago
Ales Raszka	60ef726677	Move PotentialNamespace to LayerFeature ... PotentialNamespace should be in LayerFeature instead of Feature struct. Feature extractors were updated to return LayerFeature instead of Feature.	5 years ago
Ales Raszka	34c2d96b36	featurefmt: Extract PotentialNamespace ... PotentialNamespace is feature namespace extracted while detecting features in layer. It will server for special feature detector. The current detectors return empty namespace.	5 years ago
Sida Chen	b3fe95e152	Merge pull request #724 from KeyboardNerd/ref ... database: move db logic to dbutil	5 years ago
Sida Chen	1b9ed99646	database: Move db logic to dbutil ... Move all transaction related logic to dbutil to simplify and later unify the db interface.	5 years ago
Sida Chen	046b0e49d1	Add missing licenses	5 years ago
Sida Chen	891ce1697d	imagefmt: Move layer blob download logic to blob.go	5 years ago
Sida Chen	73bc2bc36b	Merge pull request #672 from KeyboardNerd/source_package/feature_type ... Implement Feature types	5 years ago
Sida Chen	0e0d8b38bb	featurefmt: Extract source packages and binary packages ... The featurefmt now extracts both binary packages and source packages from the package manager infos.	5 years ago
Sida Chen	7dd989c0f2	database: Rename affected Type to feature type	5 years ago
Jimmy Zelinskie	cafe0976a4	Merge pull request #685 from jzelinskie/updater-cleanup ... updater: remove FindLock(), use errgroup to avoid races	5 years ago
Jimmy Zelinskie	25078ac838	ext: add CleanAll() utility functions	5 years ago
Flavio Castelli	5a4d4913c1	Reintroduce image scanning for openSUSE and SLE ... Handle scanning of openSUSE and SUSE Linux Enterprise images. Signed-off-by: Flavio Castelli <fcastelli@suse.com>	5 years ago
Ales Raszka	bd7102d963	Vulnsrc rhel: handle "none" CVE impact ... Some RHEL CVEs [1] contains "none" string in impact field. This is throwing warning message when fetching vulnerabilities. The new code handles this case and it uses advisory severity instead. [1] https://www.redhat.com/security/data/oval/com.redhat.rhsa-20080038.xml	5 years ago
Geoff Baskwill	3503ddb96f	vulnsrc_oracle: one vulnerability per CVE ... Get one vulnerability per CVE for Oracle instead of one per ELSA so we can have NVD metadata added to the vulnerabilities. Related: #495, #499.	6 years ago
Sida Chen	05cbf328aa	Merge pull request #647 from KeyboardNerd/spkg/cvrf ... vulnsrc: Refactor debian and alpine sources	6 years ago
Sida Chen	72674ca871	vulnsrc: Refactor vulnerability sources to use utility functions	6 years ago
Jimmy Zelinskie	0c2e5e73c2	Merge pull request #645 from Katee/include-cvssv3 ... Switch to NVD JSON feed and include CVSSv3	6 years ago
Kate Murphy	081ae34af1	ext: remove duplicate vectorValuesToLetters definition	6 years ago
Kate Murphy	4f0da12b12	ext: pass through CVSSv3 impact and exploitability score	6 years ago
Jimmy Zelinskie	8efc3e4038	ext: remove unneeded use of init()	6 years ago
Jimmy Zelinskie	699d1143e5	ext: fixup incorrect copyright year	6 years ago
Sida Chen	2236b0a5c9	updater: Add vulnsrc affected feature type ... Each vulnerability source has a specific type of feature that it affects We assume the following: * Alpine: Binary Package * Debian: Source Package * Ubuntu: Source Package * Oracle OVAL: Binary Package * RHEL OVAL: Binary Package	6 years ago
Kate Murphy	b81e4454fb	ext: Parse CVSSv3 data from JSON NVD feed	6 years ago
Kate Murphy	14277a8f5d	ext: Add JSON NVD parsing tests	6 years ago
Kate Murphy	aab46f5658	ext: Parse NVD JSON feed instead of XML ... The JSON feed provides some values that are not available in the XML feed such as CVSSv3.	6 years ago
Sida Chen	f759dd54c0	database: Replace Parent Feature with source metadata ... Feature's source feature string is directly stored in the database instead of having the parent pointer to simplify the database.	6 years ago
Jimmy Zelinskie	2ac088dd0f	Merge pull request #639 from Katee/update-sha1-to-sha256 ... Use SHA256 instead of SHA1 for fingerprinting	6 years ago
Kate Murphy	8d5a0131c4	ext: Use SHA256 instead of SHA1 for fingerprinting ... To make static analysis tools happy. The current use of SHA1 for fingerprinting is safe. However, there is very little downside to switching to SHA256.	6 years ago
Sida Chen	2cc61f9fc0	ext/featurefmt/apk: Extract origin package information from database ... "o" field is used to extract the Package Origin from the APK database.	6 years ago
Sida Chen	a057e4a943	ext/featurefmt/rpm: Extract source package from rpm database ... Source package is now extracted from the RPM database by using ${SourceRPM} option in the rpm --qf argument.	6 years ago
Sida Chen	4ac046642f	ext/featurefmt/dpkg: Extract source package metadata ... The source package metadata is extracted from the source line instead of forcing the binary package to have source package information.	6 years ago
Sida Chen	1c40e7d016	ext/featurefmt: Refactor featurefmt testing code ... 1. Featurefmt testing code is moved to featurefmttest package. 2. Featurefmt now can be tested against a csv file, which contains the expected package information result.	6 years ago
Sida Chen	3c72fa29a6	Merge pull request #620 from KeyboardNerd/feature/detector ... Internally version all detected content by extension	6 years ago
Sida Chen	e657d26313	database: move dbutil and testutil to database from pkg ... Move dbutil and testutil to database from pkg Rename all "result"	6 years ago
Sida Chen	53bf19aecf	ext: Lister and Detector returns detector info with detected content ... 1. Every Lister and Detector are versioned 2. detected content, are returned in a map with detector info as the key	6 years ago
Jimmy Zelinskie	0ca9431235	Merge pull request #621 from jzelinskie/gitutil ... pkg/gitutil: init	6 years ago
Jimmy Zelinskie	44ae4bc959	Merge pull request #610 from MackJM/wip/master_nvd_httputil ... Using httputil for NVD	6 years ago
Jimmy Zelinskie	c2d887f9e9	pkg/gitutil: init ... This refactors the code we're using to manage temporary git repositories into a utility package.	6 years ago
Grégoire Unbekandt	c4ffa0c370	vulnsrc_rhel: cve impact ... use the specific CVE's impact field instead of the RHSA's one	6 years ago
Grégoire Unbekandt	a90db713a2	vulnsrc_rhel: add test ... Add test for multiple CVE	6 years ago
Grégoire Unbekandt	8b3338ef56	vulnsrc_rhel: minor changes ... delete a useless line	6 years ago
Grégoire Unbekandt	4e4e98f328	vulnsrc_rhel: minor changes ... Code reorganisation	6 years ago