История

Tatiana Bradley 2b185852c9 all: move triage-related code to its own package Separate triage-related code to its own internal package so it can be re-used throughout. Change-Id: I1c143624d718b896edb64afa020875925210b094 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/601378 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com>		2024-07-30 15:43:52 +00:00
..
log	internal/worker/log: use slog	2024-01-08 16:23:52 +00:00
static	internal/worker: remove code related to module scanning	2024-06-13 13:52:49 +00:00
store	all: fix lints	2024-07-29 18:12:34 +00:00
testdata	internal/proxy: use latest instead of list to test existence	2024-06-28 15:27:33 +00:00
README.md	internal/worker/README.md: update instructions for browsing the worker	2022-07-28 06:39:11 +00:00
config.go	cmd,internal: add tools and worker code	2021-12-20 22:08:22 +00:00
false_positive_records.gen.go	internal/worker: rename CVERecord and GHSARecord	2024-06-13 13:52:24 +00:00
false_positives.go	internal/worker: unify some firestore functions	2024-06-13 13:52:38 +00:00
false_positives_test.go	internal/worker: rename CVERecord and GHSARecord	2024-06-13 13:52:24 +00:00
gen_false_positives.go	internal/worker: rename CVERecord and GHSARecord	2024-06-13 13:52:24 +00:00
server.go	internal/worker: remove code related to module scanning	2024-06-13 13:52:49 +00:00
server_test.go	cmd,internal: add tools and worker code	2021-12-20 22:08:22 +00:00
update.go	all: move triage-related code to its own package	2024-07-30 15:43:52 +00:00
update_test.go	all: move triage-related code to its own package	2024-07-30 15:43:52 +00:00
util.go	all: rename cveschema5 and cveschema to cve5 and cve4	2024-05-15 14:51:25 +00:00
worker.go	all: move triage-related code to its own package	2024-07-30 15:43:52 +00:00
worker_test.go	internal/report: fix issue tracker link in xrefs	2024-07-22 22:56:43 +00:00

README.md

Go Vulnerability Worker

The vuln worker triages incoming security advisories and scans selected modules for vulnerabilities.

The Go security team runs the worker on Google Cloud Platform's Cloud Run product. See the repo's terraform directory for more on the deployment setup.

The main program for the worker, in the repo's cmd/worker directory, can also be used as a command-line tool for one-off executions of some of the server's actions.

Browsing the worker

Accessing the worker server's home page from a browser requires authentication. We recommend cloud-run-proxy for painless browsing. Install it with

go install github.com/GoogleCloudPlatform/cloud-run-proxy@latest

Run it from the repo root with

./devtools/proxy_worker.sh prod