Add Almalinux advisories #1491

ambuj-1211 · 2024-06-22T20:42:50Z

Fix #1201
@ziadhany @TG1999 @keshav-space This is the basic nit to adds Alma Linux advisories into vulnerablecode database, please review it to make further changes.

Added almalinux advisories and tests for it Signed-off-by: ambuj <kulshreshthaak.12@gmail.com>

ambuj-1211 · 2024-06-22T20:55:03Z

@ziadhany as this importer uses osv.py importer so shall I add AlmaLinux:8 and AlmaLinux:9 in supported ecosystems in osv.py

ziadhany · 2024-06-22T21:28:09Z

@ambuj-1211 yes, you should add it to this PURL_TYPE_BY_OSV_ECOSYSTEM dict.

Signed-off-by: ambuj <kulshreshthaak.12@gmail.com>

ziadhany · 2024-06-24T13:38:21Z

@ambuj-1211
I looked into your code. Instead of using uppercase, you should use lowercase. then you are going to pass the test.

PURL_TYPE_BY_OSV_ECOSYSTEM = {
     ....
    "almalinux:8": "almalinux:8",
    "almalinux:9": "almalinux:9",
}

but you will face another issue. you need to add support for almalinux in univers.

https://github.com/nexB/univers/blob/205d7c48835dfeb6b694c9196728d2b4fa0a011a/src/univers/version_range.py#L1254:L1258

Signed-off-by: ambuj <kulshreshthaak.12@gmail.com>

ambuj-1211 · 2024-07-12T00:28:31Z

vulnerabilities/importers/almalinux.py

+    return dedupe(fixed_versions)
+
+
+def get_affected_version_range(affected_pkg, raw_id, supported_ecosystem):


@ziadhany unable to figure out how to find affected version range

@ambuj-1211, we don't handle getting the affected version range from introduced and fixed in OSV. We only obtain this using versions.

I recommend handling this in a separate issue. Please create one for it.

Additionally, please review the following link:
https://github.com/nexB/vulnerablecode/blob/main/vulnerabilities/tests/test_osv.py#L270

If we don't have a affected versions set this as null.

@ziadhany I have done some changes, let me know if it require something else and also tell me if I need to squash the commits to make the history cleaner. And do I need to select update with rebase for this branch?

Signed-off-by: ambuj <kulshreshthaak.12@gmail.com>

TG1999 · 2024-07-22T15:04:08Z

@ziadhany can this be merged ?

ziadhany · 2024-08-05T10:44:51Z

@ziadhany can this be merged ?

I still need to review this code

vulnerabilities/importers/almalinux.py

…tion - Added a detailed docstring to the `parse_advisory_data` function in the `almalinux-importer` module. - The docstring includes a clear description of the function's purpose, arguments, return value, and an example usage. - Improved the readability and structure of the example output in the docstring to ensure clarity and consistency. This documentation enhancement makes the `parse_advisory_data` function easier to understand and use, aiding future development and maintenance. Signed-off-by: ambuj <kulshreshthaak.12@gmail.com>

ziadhany

@ambuj-1211

Why not use the existing OSV script directly or modify it to support Almalinux, instead of rewriting the entire code?

ziadhany · 2024-08-31T14:03:12Z

vulnerabilities/importers/almalinux.py

+import json
+import logging
+from pathlib import Path
+from typing import Any


Suggested change

from typing import Any

ziadhany · 2024-08-31T14:12:58Z

vulnerabilities/importers/almalinux.py

+from univers.version_range import RANGE_CLASS_BY_SCHEMES
+from univers.version_range import RpmVersionRange
+from univers.versions import InvalidVersion


@ambuj-1211 please remove the unused imports.

Suggested change

from univers.version_range import RANGE_CLASS_BY_SCHEMES

from univers.version_range import RpmVersionRange

from univers.versions import InvalidVersion

ziadhany · 2024-08-31T14:21:47Z

vulnerabilities/importers/almalinux.py

+from vulnerabilities.utils import get_cwe_id
+
+logger = logging.getLogger(__name__)
+BASE_URL = "https://github.com/AlmaLinux/osv-database"


Please keep the URL within the importer class.

ziadhany · 2024-08-31T14:36:21Z

vulnerabilities/importers/almalinux.py

+        try:
+            self.clone(repo_url=self.BASE_URL)
+            base_path = Path(self.vcs_response.dest_dir)
+            advisory_dirs = base_path / "tree/master/advisories"


@ambuj-1211 This path isn't functioning; the importer isn't actually importing any data.

Suggested change

advisory_dirs = base_path / "tree/master/advisories"

advisory_dirs = base_path / "advisories/"

Please ensure you run the importer and verify the data is correctly imported.

ziadhany · 2024-08-31T14:54:18Z

vulnerabilities/importers/almalinux.py

+    spdx_license_expression = "MIT License"
+    license_url = "https://github.com/AlmaLinux/osv-database/blob/master/LICENSE"
+    importer_name = "Alma Linux Importer"
+


Suggested change

repo_url = "git+https://github.com/AlmaLinux/osv-database"

ziadhany · 2024-08-31T14:58:22Z

vulnerabilities/importers/almalinux.py

+
+
+class AlmaImporter(Importer):
+    spdx_license_expression = "MIT License"


Please refer to https://spdx.org/licenses/ before writing the SPDX license expression.

Suggested change

spdx_license_expression = "MIT License"

spdx_license_expression = "MIT"

ziadhany · 2024-09-09T16:02:41Z

@ambuj-1211 Update the OSV get_affected_purl function to add support for AlmaLinux, just like we did for Maven.

vulnerablecode/vulnerabilities/importers/osv.py

Line 190 in 2888d29

def get_affected_purl(affected_pkg, raw_id):

Add Almalinux advisories

d51b973

Added almalinux advisories and tests for it Signed-off-by: ambuj <kulshreshthaak.12@gmail.com>

added supported ecosystem to osv.py file

c6e95bb

Signed-off-by: ambuj <kulshreshthaak.12@gmail.com>

ambuj-1211 added 3 commits June 25, 2024 19:16

added some more tests

d7002f9

Signed-off-by: ambuj <kulshreshthaak.12@gmail.com>

add tests for almalinux versions

4746d78

Signed-off-by: ambuj <kulshreshthaak.12@gmail.com>

corrected the formating errors by running make valid

d2f6945

Signed-off-by: ambuj <kulshreshthaak.12@gmail.com>

TG1999 requested a review from ziadhany July 9, 2024 15:22

modified almalinux importer

c328dbd

Signed-off-by: ambuj <kulshreshthaak.12@gmail.com>

ambuj-1211 commented Jul 12, 2024

View reviewed changes

ambuj-1211 added 2 commits July 13, 2024 19:09

add almalinux advisories latest

511cdda

Signed-off-by: ambuj <kulshreshthaak.12@gmail.com>

correct some doctest almalinux importer

86c18cf

Signed-off-by: ambuj <kulshreshthaak.12@gmail.com>

Merge branch 'main' into add-almalinux-advisories

e82f47e

ziadhany reviewed Aug 9, 2024

View reviewed changes

vulnerabilities/importers/almalinux.py Show resolved Hide resolved

ambuj-1211 added 2 commits August 20, 2024 18:51

Merge branch 'main' into add-almalinux-advisories

c679856

AyanSinhaMahapatra requested review from ziadhany and TG1999 August 26, 2024 14:57

ziadhany requested changes Aug 31, 2024

View reviewed changes

Merge branch 'main' into add-almalinux-advisories

4dcc863

TG1999 added this to the v36.0.0 - 3-next milestone Oct 15, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Almalinux advisories #1491

Add Almalinux advisories #1491

ambuj-1211 commented Jun 22, 2024

ambuj-1211 commented Jun 22, 2024

ziadhany commented Jun 22, 2024 •

edited

Loading

ziadhany commented Jun 24, 2024

ambuj-1211 Jul 12, 2024

ziadhany Jul 12, 2024

ambuj-1211 Jul 13, 2024 •

edited

Loading

TG1999 commented Jul 22, 2024

ziadhany commented Aug 5, 2024

ziadhany left a comment

ziadhany Aug 31, 2024

ziadhany Aug 31, 2024

ziadhany Aug 31, 2024

ziadhany Aug 31, 2024

ziadhany Aug 31, 2024

ziadhany Aug 31, 2024

ziadhany commented Sep 9, 2024

		return dedupe(fixed_versions)


		def get_affected_version_range(affected_pkg, raw_id, supported_ecosystem):

	from univers.version_range import RANGE_CLASS_BY_SCHEMES
	from univers.version_range import RpmVersionRange
	from univers.versions import InvalidVersion

	advisory_dirs = base_path / "tree/master/advisories"
	advisory_dirs = base_path / "advisories/"



		class AlmaImporter(Importer):
		spdx_license_expression = "MIT License"

	spdx_license_expression = "MIT License"
	spdx_license_expression = "MIT"

Add Almalinux advisories #1491

Are you sure you want to change the base?

Add Almalinux advisories #1491

Conversation

ambuj-1211 commented Jun 22, 2024

ambuj-1211 commented Jun 22, 2024

ziadhany commented Jun 22, 2024 • edited Loading

ziadhany commented Jun 24, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ambuj-1211 Jul 13, 2024 • edited Loading

Choose a reason for hiding this comment

TG1999 commented Jul 22, 2024

ziadhany commented Aug 5, 2024

ziadhany left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ziadhany commented Sep 9, 2024

ziadhany commented Jun 22, 2024 •

edited

Loading

ambuj-1211 Jul 13, 2024 •

edited

Loading