toolchainvuln

package

v0.0.21 Latest Latest Go to latest Published: Mar 7, 2026 License: MIT Imports: 17 Imported by: 0

Details

This section is empty.

View Source

var AnnouncementPassword string

AnnouncementPassword is the password required to POST announcements. Set from config file. If empty, the endpoint is disabled.

func BuildCVEToGoIDMap(entries []VulnEntry) map[string]string

BuildCVEToGoIDMap creates a map from CVE ID to GO ID.

func InsertToolchainVuln(ctx context.Context, goVersion, cveID string, releasedAt time.Time) error

InsertToolchainVuln inserts a toolchain vulnerability record into the database.

func ParseReleaseAnnouncement(subject, body string) (versions []string, cves []string)

ParseReleaseAnnouncement parses a Go release announcement email and extracts the Go versions and CVE IDs.

func ReceiveAnnouncement(w http.ResponseWriter, req *http.Request)

ReceiveAnnouncement handles POST requests with Go release announcement emails.

func ServeDashboard(w http.ResponseWriter, req *http.Request)

func SyncVulnDatabase(ctx context.Context) error

SyncVulnDatabase checks unpublished vulnerabilities against vuln.go.dev and updates them.

type UnpublishedVuln struct {
	GoVersion string `sql:"goversion"`
	CVEID     string `sql:"cveid"`
}

UnpublishedVuln represents a toolchain_vuln row with null goid.

type VulnEntry struct {
	ID       string   `json:"id"`
	Modified string   `json:"modified"`
	Aliases  []string `json:"aliases"`
}

VulnEntry represents an entry in the vuln.go.dev index.

func FetchVulnIndex(ctx context.Context) ([]VulnEntry, error)

FetchVulnIndex downloads and parses the vuln.go.dev index.

type VulnRecord struct {
	ID        string `json:"id"`
	Published string `json:"published"`
}

VulnRecord represents the full vulnerability record from vuln.go.dev.

func FetchVulnRecord(ctx context.Context, goID string) (*VulnRecord, error)

FetchVulnRecord downloads and parses a specific vulnerability record.