advisoryfeed

package
v0.9.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 6, 2026 License: Apache-2.0 Imports: 16 Imported by: 0

Documentation

Overview

Package advisoryfeed reads a file based advisory feed and matches the images apps run against it. It is off unless a feed is configured.

Index

Constants

View Source 
const (
	SeverityCritical = "critical"
	SeverityHigh     = "high"
	SeverityMedium   = "medium"
	SeverityLow      = "low"
)

Severities, highest first.

View Source 
const (
	EnvFeed     = "APP_ADVISORY_FEED"
	EnvPubKey   = "APP_ADVISORY_FEED_PUBKEY"
	EnvRefresh  = "APP_ADVISORY_FEED_REFRESH"
	EnvMaxBytes = "APP_ADVISORY_FEED_MAX_BYTES"
)

Environment variables. Everything is off while EnvFeed is empty.

View Source 
const (
	SigUnsigned = "unsigned"
	SigVerified = "verified"
	SigInvalid  = "invalid"
)

Signature states shown wherever a feed is shown. Unsigned means no public key is configured, so the content is not authenticated.

View Source 
const SchemaVersion = 1

SchemaVersion is the only feed version this build understands.

Variables

This section is empty.

Functions

func NormalizeRepository 

func NormalizeRepository(s string) string

NormalizeRepository lowercases and strips the default registry and library prefixes so "node" and "docker.io/library/node" compare equal.

func ParsePublicKey 

func ParsePublicKey(s string) (ed25519.PublicKey, error)

ParsePublicKey decodes a base64 ed25519 public key from configuration.

func SeverityRank 

func SeverityRank(s string) int

SeverityRank orders severities, higher is worse; unknown is 0.

func Verify 

func Verify(key ed25519.PublicKey, data, sigB64 []byte) error

Verify checks a base64 detached ed25519 signature over the exact feed bytes.

Types

type Affected 

type Affected struct {
	Repository string   `json:"repository"`
	Digests    []string `json:"digests,omitempty"`
	Tags       []string `json:"tags,omitempty"`
	Ranges     []Range  `json:"ranges,omitempty"`
}

Affected names an image repository and the content that is affected. At least one of Digests, Tags or Ranges is required so an entry never matches a whole repository by accident.

type Config 

type Config struct {
	Source   string
	PubKey   string
	Refresh  time.Duration
	MaxBytes int64
}

Config is read once from the environment.

func ConfigFromEnv 

func ConfigFromEnv(lookup func(string) string) Config

ConfigFromEnv reads the feed settings through lookup.

type Entry 

type Entry struct {
	ID        string     `json:"id"`
	Severity  string     `json:"severity"`
	Summary   string     `json:"summary"`
	Affected  []Affected `json:"affected"`
	FixedIn   string     `json:"fixed_in,omitempty"`
	Reference string     `json:"reference,omitempty"`
}

Entry is one advisory.

type Feed 

type Feed struct {
	Version     int       `json:"version"`
	GeneratedAt time.Time `json:"generated_at,omitempty"`
	Entries     []Entry   `json:"entries"`
}

Feed is the document an operator or a publisher provides.

func Parse 

func Parse(data []byte) (Feed, error)

Parse decodes and validates a feed document.

type Image 

type Image struct {
	App    string `json:"app"`
	Ref    string `json:"image"`
	Digest string `json:"digest,omitempty"`
}

Image is one running image of an app. Digest may be empty.

type Match 

type Match struct {
	App        string `json:"app"`
	Image      string `json:"image"`
	Digest     string `json:"digest,omitempty"`
	AdvisoryID string `json:"advisory_id"`
	Severity   string `json:"severity"`
	Summary    string `json:"summary"`
	FixedIn    string `json:"fixed_in,omitempty"`
	Reference  string `json:"reference,omitempty"`
	Hint       string `json:"hint"`
}

Match is one advisory that applies to one running image.

func MatchImages 

func MatchImages(f Feed, images []Image) []Match

MatchImages compares every image against every advisory. The result is ordered worst severity first, then app, then advisory id.

type Range 

type Range struct {
	From   string `json:"from,omitempty"`
	Before string `json:"before"`
}

Range is a tag version interval, From inclusive and Before exclusive.

type Service 

type Service struct {
	// contains filtered or unexported fields
}

Service loads the feed lazily and caches matches until the feed or the image set changes. There is no background loop.

func New 

func New(cfg Config, client *http.Client) *Service

New returns a service; a zero Source makes every call a no-op.

func (*Service) Enabled 

func (s *Service) Enabled() bool

Enabled reports whether a feed is configured.

func (*Service) Match 

func (s *Service) Match(ctx context.Context, images []Image) (Snapshot, []Match)

Match returns the feed and its matches for images. The result is cached until the feed or the image set changes.

func (*Service) Snapshot 

func (s *Service) Snapshot(ctx context.Context) Snapshot

Snapshot returns the current feed, reloading only when the file changed or a remote feed is older than the refresh interval.

type Snapshot 

type Snapshot struct {
	Enabled     bool      `json:"enabled"`
	Source      string    `json:"source,omitempty"`
	Signature   string    `json:"signature,omitempty"`
	Error       string    `json:"error,omitempty"`
	GeneratedAt time.Time `json:"generated_at,omitempty"`
	LoadedAt    time.Time `json:"loaded_at,omitempty"`
	Entries     []Entry   `json:"entries"`
	Fingerprint string    `json:"-"`
}

Snapshot is the loaded feed and how far it can be trusted.

func (Snapshot) UsesDigests 

func (s Snapshot) UsesDigests() bool

UsesDigests reports whether any entry selects by digest, so callers can skip resolving digests when none can match.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.