When resolving vulnerable symbols, we create a temporary module which
depends on the vulnerable package. Construct this temporary module's
go.mod file with "go mod tidy" rather than "go get -u", which seems
to do a better of job of resolving the dependencies for packages
in the Kubernetes ecosystem. Allows vulnreport fix to work on
GO-2023-1549.
Change-Id: I50a71807411a3bab896b5982186d3e57fa1d941b
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/470376
TryBot-Result: Gopher Robot <gobot@golang.org>
Run-TryBot: Damien Neil <dneil@google.com>
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
Stop publishing ".gz" files, but preserve the code to do it. Allow
a database to be considered valid whether or not the ".gz" files are
present.
Change-Id: I3d3ee65d042d326862028ea0536ac5fee9239ab1
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/474117
Run-TryBot: Tatiana Bradley <tatianabradley@google.com>
Reviewed-by: Julie Qiu <julieqiu@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
Use GCS's auto-gzip functionality in deploy step. This allows
all the JSON files to be stored in compressed form but only sent
compressed to clients that request it.
This paves the way to remove the ".gz" database files.
Change-Id: Ibe69d2c75cef20aa315031dbb69952e9c2c06189
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/474116
Reviewed-by: Julie Qiu <julieqiu@google.com>
Run-TryBot: Tatiana Bradley <tatianabradley@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
In all future deploys, deploy index.html file as "index.html" instead of
"index", to avoid a naming conflict with the new "index/" folder.
Instructions in README are also updated accordingly.
Change-Id: I9f9e5bb994cb53afe0945459acbbe753234ed3a9
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/473755
Reviewed-by: Julie Qiu <julieqiu@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Run-TryBot: Tatiana Bradley <tatianabradley@google.com>
Change RawLoad to Load in v1 Validate so that the existing database
is validated against the v1 spec before deploy. This was previously
"RawLoad" because on first deploy the existing database was not a valid
v1 database.
For golang/go#58816
Change-Id: I45728266ae0b59b6fd486d196a2a91a712aaf12e
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/473195
Run-TryBot: Tatiana Bradley <tatianabradley@google.com>
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Damien Neil <dneil@google.com>
Generate and validate, but don't actually deploy, the v1 database
in the deploy script. Once we have confidence that this works, we
can deploy the v1 database.
For golang/go#58816
Change-Id: I69340c76d2514b11ed3d1937b604478903706afc
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/472884
Reviewed-by: Damien Neil <dneil@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Run-TryBot: Tatiana Bradley <tatianabradley@google.com>
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
Ignore ".gz" and "index/" files (from the v1 spec) when loading a legacy
db. This will allow a database containing both the legacy and v1 index
files to be considered a valid legacy db in pre-deploy checks.
For golang/go#58816
Change-Id: I1d96bd0fbfba3ed6e2062ed904e48a4dbcee7217
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/472883
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
Run-TryBot: Tatiana Bradley <tatianabradley@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Adds a function, Equivalent, which checks if a database in the legacy
format is the same as a database in the v1 format. This will be
used as a pre-deploy check.
For golang/go#58816
Change-Id: I936111882837fc461d2c2819133ac43f5639ab44
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/472882
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
Run-TryBot: Tatiana Bradley <tatianabradley@google.com>
Adds a function FromRepo that can generate a v1 database from a git
repo (e.g., vulndb) containing OSV files. Also adds end-to-end tests
for all database functionality.
For golang/go#58816
Change-Id: Ice021f558c953039ba420e1ce613ea8e213243dc
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/472881
Run-TryBot: Tatiana Bradley <tatianabradley@google.com>
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Damien Neil <dneil@google.com>
Adds functionality to validate that a v1 database is safe to deploy.
For golang/go#58816
Change-Id: I18400553b872afc026daf294e0c9b5c0d3333d98
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/472880
Run-TryBot: Tatiana Bradley <tatianabradley@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-by: Zvonimir Pavlinovic <zpavlinovic@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Adds a function, New, which creates a database in the v1 schema from
OSV entries.
For golang/go#58816
Change-Id: I7513419bc151c69ed4a8b48d78b817d50a6d7b90
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/472878
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
Run-TryBot: Tatiana Bradley <tatianabradley@google.com>
Adds a struct, Database, which represents a Go vulnerabililty database
in the v1 schema. Also adds test data (which will be used by functions
in later CLs), and tests for marshaling and unmarshaling this struct.
For golang/go#58816
Change-Id: Iea453227008cf68a9f43889b10fedd56953ba3f3
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/472877
Run-TryBot: Tatiana Bradley <tatianabradley@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
Reviewed-by: Zvonimir Pavlinovic <zpavlinovic@google.com>
Adds "github.com/astaxie/beego", which is also affected by these
vulnerabilities.
Thanks to Ludovic Lang @ ControlPlane for reporting.
Change-Id: I008aac19dc5373d742b2a0c4fadd55319e026e3f
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/471777
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Damien Neil <dneil@google.com>
Run-TryBot: Tatiana Bradley <tatianabradley@google.com>
Adds a new package "legacydb" to contain all code related to generating
and validating the Go vulnerability database according to the legacy
schema, which will be replaced soon.
This will make it easier to delete this code once it is no
longer needed.
Change-Id: Iaf57213fd720d8d9293c018b1f302928dd239bf8
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/471215
Reviewed-by: Julie Qiu <julieqiu@google.com>
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
Run-TryBot: Tatiana Bradley <tatianabradley@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Change-Id: I866e9c55973f7a2a921a0cc762a593dbbb16b29d
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/469101
TryBot-Result: Gopher Robot <gobot@golang.org>
Auto-Submit: Tim King <taking@google.com>
Run-TryBot: Tim King <taking@google.com>
Reviewed-by: Zvonimir Pavlinovic <zpavlinovic@google.com>
Fixes two issues with vulnreport's handling of reports in
the standard library:
- No longer overwrites package name with "std"
- No longer populates "cves" field if cve_metadata is present
(cve_metadata indicates we assigned the CVE)
Change-Id: I75892fe2464d54fb9e3e6d077518e5e602103c1b
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/468895
Run-TryBot: Tatiana Bradley <tatianabradley@google.com>
Reviewed-by: Tim King <taking@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Tatiana Bradley
Roland Shoemaker
Damien Neil
Zvonimir Pavlinovic
Tim King
Maceo Thompson