Convert Red Hat CSAF VEX files to OSV database format

[nvtnlucie]

Red Hat publishes vulnerability data in CSAF VEX format. To facilitate easier consumption of this data by Renovate, this PR converts these CSAF VEX files into OSV database format. The script takes an url as input (from https://security.access.redhat.com/data/csaf/v2/advisories/2024/), and outputs a .nedb file containing osv vulnerability data (with the same fields as https://github.com/renovatebot/osv-offline/releases , except in the scope of this task the file contains vulnerabilities from one advisory only). There is a main() function used to demonstrate how it works, which will be deleted once CWFHEALTH-3440 is implemented. These outputs were tested to validate against https://raw.githubusercontent.com/ossf/osv-schema/main/validation/schema.json .

The script also ignores everything which is not a rpm dependency. I am not sure about the name (or placement) of this module yet, I am accepting suggestions :).

Closes CWFHEALTH-3757.

[qixiang]

@nvtnlucie I'd suggest to add the new package in a new directory, for example tools/osv-generator, then the main package can be placed at cmd/osv-generator:

cmd
├── manager
│   └── main.go
└── osv-generator
    └── main.go

wdyt?

[nvtnlucie]

Yes, that looks much better, its updated 👍

[qixiang]

Red Hat just started to publish the data to osv.dev, we may need to change our plan on this, I've added the information to the jira issue.

[nvtnlucie]

@qixiang FIY: I added rest of the code into this PR. If you run cmd/osv-generator/main.go you will receive a file containing all osv data which were modified in the past 24 hours. This file can be used for further testing of rpm functionality. I will leave the rest of the code as is until we receive answers about osv.dev.

[nvtnlucie]

Update: I added the remaining code needed for the script. Its divided into two parts, cve_parser.go provides code necessary for converting VEX file into OSV file. The second file generator.go then collects recently published advisories and converts their content into one file. It currently utilizes getAdvisoryListByModified function, which takes changes.csv file as an input and gathers 200 latest CVEs. If security team were to provide published.csv as well, optimization could be made by using getAdvisoryListByPublished function instead (which would be able to load all CVE produced in the past day for example). But honestly it works completely fine even with changes.csv.

@qixiang @FernandesMF @querti @gnaponie , please take a look when you have some time, and don't be scared of the length as a lot of LoC are there because of object definitions and test objects.

[nvtnlucie]

@querti @qixiang What do you say, can I merge this? The objects defined here can be then extended and used for container support as well.

[qixiang]

@querti @qixiang What do you say, can I merge this? The objects defined here can be then extended and used for container support as well.

sorry @nvtnlucie , I haven't got a chance to play with this tool, I should be able to focus on this Thu or Fri, or if this looks good to @querti, we can merge it first and then continue to improve it.

[querti]

I don't have any objections to merging it, but I'm not the right person to determine if it satisfies all the requirements for RPM CVEs.

[nvtnlucie]

Its ok, I can keep it open for a little longer. But if you would want to use some feature from this @querti , feel free to merge and use it.