[pull] main from guacsec:main - #239
Merged
Merged
Conversation
Proposes a shared auth model with credential source abstraction (inline/env/file) for all HTTP-based importers, enabling production deployments to use K8s Secrets populated by Vault or ESO instead of storing credentials as plaintext in the database. Quay's legacy api_token field is deprecated in the API with backward compatibility during a transition period. Implements TC-5738 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…C-5170) Non-RPM golang (oci/maven) must not inherit the rpm/Storage-3 status; get_product_statuses_for_purl matches by name only. #[ignore] pending TC-5170. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Fix silent data loss where versionless PURLs in CSAF advisories created unbounded version ranges that never matched any version at query time. All PostgreSQL *_version_matches functions now return true for fully unbounded ranges (both bounds NULL), making "all versions" semantics work correctly. Change versionless PURL handling to be publisher-dependent: Red Hat documents (detected via publisher namespace) treat versionless PURLs as "all versions", while other publishers get empty-version exact match with Generic scheme. The existing Red Hat "fixed→affected" special case also switches from CPE vendor to publisher namespace detection. Add vers: parsing via the vers-rs crate, integrated into CSAF ingestion through BranchCategory::ProductVersionRange. When a branch has this category, its name field is parsed as a vers: URI per CSAF 2.0 spec section 3.1.2.3.2, and the resulting version range takes precedence over any PURL version. Malformed vers: strings reject the document. Un-ignore correlation tests s8 (TC-5733) and s11 (TC-5732) which now pass thanks to the unbounded range fix. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Fix two bugs in the rpmver_cmp PL/pgSQL function compared to upstream RPM's rpmvercmp: 1. Caret (^) ordering was inverted — ^ vs alpha segments returned the wrong sign. Upstream: ^ sorts after empty but before non-^ segments. 2. No epoch awareness — RPM's epoch:version prefix was not parsed. Add Purl::effective_version() which folds the epoch qualifier into the version string for RPM purls (e.g., "1:1.8.0") without modifying the Purl struct itself, preserving standard purl display/serialization. Use it for versioned_purl UUID computation, storage, and CSAF version specs so epoch is consistently carried through version comparison. Include a data migration that backfills existing versioned_purl entries for RPM packages with epoch > 0 by creating new rows with correct epoch-aware UUIDs and re-pointing qualified_purl FK references. Port 47 test cases from the upstream RPM test suite covering numeric, alpha, leading zeros, separators, tilde, caret, mixed, and epoch. Implements TC-5733 Assisted-by: Claude Code Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The embedded PostgreSQL used in tests requires libossp-uuid.so.16 to load the uuid-ossp extension. Add the system dependency to the ci and benchmark workflows. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…rsions special case The VersionRange enum's Unbounded variant could not deserialize from JSON where low_version and high_version are null (as emitted by the raw SQL query). Add a custom deserializer that matches JSON objects with both version fields null. Drop the Red Hat "all versions" special case for versionless PURLs — treating them as "all versions" caused false positives when the same advisory also contained versioned PURLs with specific fix ranges. Versionless PURLs now get empty-version exact match for all vendors. Proper "all versions" semantics come from explicit vers: ranges. Re-add #[ignore] on correlation test s11 (TC-5732) which depends on versionless known_affected matching. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…id-ossp Replace the uuid-ossp extension with Rust-side UUID v5 computation using the existing Purl::version_uuid() and effective_version() methods. This eliminates the libossp-uuid16 system dependency from CI and avoids requiring the extension in all deployment environments. The migration now pages through affected rows (LIMIT 5000) with an exclusive table lock to prevent concurrent modifications, computes deterministic UUIDs in Rust, and writes results back via chunked inserts and parameterized updates. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Assisted-by: Claude Code
…C-5171) A RHEL 8 kernel must not match the OCP-scoped kernel entry bundled in a Go CVE's advisory; product CPE context is not checked. Adds a lean go-toolset within-substream version sanity (below/at/above on .el7_9). #[ignore] pending TC-5171. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )