Skip to content

Commit 2ddfef2

Browse files
committed
Merge latest main branch
Signed-off-by: Philippe Ombredanne <[email protected]>
2 parents 1302761 + bf17aa4 commit 2ddfef2

26 files changed

+1375
-1291
lines changed

CHANGELOG.rst

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -8,36 +8,39 @@ Version v30.0.0
88
transform imported data and convert that in Vulnerabilities and Packages. Improvers can
99
also improve and refine imported and existing data as well as enrich data using external
1010
data sources. The migration to this new architecture is under way and not all importers
11-
are available. You can track the progress in this issue: https://github.com/nexB/vulnerablecode/issues/597
11+
are available.
1212
Because of these extensive changes, it is not possible to migrate existing imported
1313
data to the new schema. You will need instead to restart imports from an empty database
1414
or request access to the new vulnerablecode.io live instance.
15+
You can track the progress in this issue: https://github.com/nexB/vulnerablecode/issues/597
1516

1617
- We added new data sources including PYSEC, GitHub and GitLab.
1718

1819
- We improved the documentation including adding development examples for importers and improvers.
1920

20-
- We removed the ability to edit relationships from the UI. The UI is now read-only
21-
and we will need to design a different UI for proper review and curation of vulnerabilities.
21+
- We removed the ability to edit relationships from the UI. The UI is now read-only.
22+
- We replace the web UI with a brand new UI based on the same overall look and feel as ScanCode.io.
2223

2324
- We added support for NixOS as a Linux deployment target.
2425

2526
- The aliases of a vulnerabily are reported in the API vulnerabilities/ endpoint
2627

27-
2828
- There are breaking Changes at API level with changes in the data structure:
2929

3030
- in the /api/vulnerabilities/ endpoint:
3131

3232
- Rename `resolved_packages` to `fixed_packages`
3333
- Rename `unresolved_packages` to `affected_packages`
3434
- Rename `url` to `reference_url` in the reference list
35+
- Add is_vulnerable property in fixed and affected_packages.
3536

3637
- in the /api/packages/ endpoint:
3738

3839
- Rename `unresolved_vulnerabilities` to `affected_by_vulnerabilities`
3940
- Rename `resolved_vulnerabilities` to `fixing_vulnerabilities`
4041
- Rename `url` to `reference_url` in the reference list
42+
- Add new attribute `is_resolved`
43+
- Add namespace filter
4144

4245
- We have provided backward compatibility for `url` and `unresolved_vulnerabilities` for now
4346

@@ -66,8 +69,6 @@ Version v30.0.0
6669
their API Key in the REST API.
6770
Users can be created using the Django "createsuperuser" management command.
6871

69-
- Add is_vulnerable property in fixed and affected_packages.
70-
7172
Other:
7273

7374
- we dropped calver to use a plain semver.

docs/source/command-line-interface.rst

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ Command Line Interface
66
The main entry point is Django's :guilabel:`manage.py` management commands.
77

88
``$ ./manage.py --help``
9-
-----------------------
9+
------------------------
1010

1111
Lists all sub-commands available, including Django built-in commands.
1212
VulnerableCode's own commands are listed under the ``[vulnerabilities]`` section::

docs/source/conf.py

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,8 @@
1818
# -- Project information -----------------------------------------------------
1919

2020
project = "VulnerableCode"
21-
copyright = "nexb Inc. and others"
22-
author = "nexb Inc. and others"
21+
copyright = "nexB Inc. and others"
22+
author = "nexB Inc. and others"
2323

2424

2525
# -- General configuration ---------------------------------------------------

docs/source/importers_link.rst

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
.. _importers_link:
2+
3+
Importers
4+
=========
5+
6+
.. include:: ../../SOURCES.rst

docs/source/installation.rst

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@ Local development installation
109109
Supported Platforms
110110
^^^^^^^^^^^^^^^^^^^
111111

112-
**VulnerableCode* has been tested and is supported on the following operating systems:
112+
**VulnerableCode** has been tested and is supported on the following operating systems:
113113

114114
#. **Debian-based** Linux distributions
115115
#. **macOS** 12.1 and up
@@ -122,7 +122,7 @@ Pre-installation Checklist
122122

123123
Before you install VulnerableCode, make sure you have the following prerequisites:
124124

125-
* **Python: 3.8+* found at https://www.python.org/downloads/
125+
* **Python: 3.8+** found at https://www.python.org/downloads/
126126
* **Git**: most recent release available at https://git-scm.com/
127127
* **PostgreSQL**: release 10 or later found at https://www.postgresql.org/ or
128128
https://postgresapp.com/ on macOS
@@ -212,8 +212,6 @@ application.
212212
This setup is **not suitable for deployments** and **only supported for local
213213
development**.
214214

215-
An overview of the web application usage is available at :ref:`user_interface`.
216-
217215

218216
Upgrading
219217
^^^^^^^^^

docs/source/introduction.rst

Lines changed: 13 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@ VulnerableCode is a work-in-progress towards a free and open vulnerabilities
77
database and the packages they impact and the tools to aggregate and correlate
88
these vulnerabilities.
99

10-
Why VulnerableCode ?
11-
---------------------
10+
Why VulnerableCode?
11+
-------------------
1212

1313
The existing solutions are commercial proprietary vulnerability databases, which
1414
in itself does not make sense because the data is about FOSS (Free and Open
@@ -27,12 +27,12 @@ security issues because:
2727
fundamental questions "Is package foo vulnerable" and "Is package foo
2828
vulnerable to vulnerability bar?"
2929

30-
How does it work ?
31-
-------------------
30+
How does it work?
31+
-----------------
3232

3333
VulnerableCode independently aggregates many software vulnerability data sources
3434
and supports data re-creation in a decentralized fashion. These data sources
35-
(see complete list `here <./SOURCES.rst>`_) include security advisories
35+
(see complete list :ref:`here <importers_link>`) include security advisories
3636
published by Linux and BSD distributions, application software package managers
3737
and package repositories, FOSS projects, GitHub and more. Thanks to this
3838
approach, the data is focused on specific ecosystems yet aggregated in a single
@@ -59,14 +59,17 @@ exposure due to various reasons like but not limited to the complicated
5959
procedure to receive CVE ID or not able to classify a bug as a security
6060
compromise.
6161

62-
Recent presentations:
6362

64-
- `Open Source Summit 2020 <https://github.com/nexB/vulnerablecode/blob/main/docs/Presentations/Why-Is-There-No-Free-Software-Vulnerability-Database-v1.0.pdf>`_
63+
Is VulnerableCode being actively developed?
64+
-------------------------------------------
6565

66-
Should I use VulnerableCode ?
67-
-------------------------------
66+
Yes -- VulnerableCode is a work in progress! Please stay in touch on our `Gitter channel <https://gitter.im/aboutcode-org/vulnerablecode>`_; and if you have any feedback, feel free to `enter an issue in our GitHub repo <https://github.com/nexB/vulnerablecode/issues>`_.
6867

69-
VulnerableCode is a work in progress project and will likely go through major changes. Please stay in touch on our `Gitter channel <https://gitter.im/aboutcode-org/vulnerablecode>`_
68+
69+
Recent presentations
70+
--------------------
71+
72+
- `Open Source Summit 2020 <https://github.com/nexB/vulnerablecode/blob/main/docs/Presentations/Why-Is-There-No-Free-Software-Vulnerability-Database-v1.0.pdf>`_
7073

7174
.. Some of this documentation is borrowed from the metaflow documentation and is also
7275
under Apache-2.0

docs/source/reference_importer_overview.rst

Lines changed: 16 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -3,34 +3,33 @@
33
Importer Overview
44
==================
55

6-
Importers are responsible to scrape vulnerability data from various data sources without creating
7-
a complete relational model between vulnerabilites, their fixes and store them in a structured
8-
fashion.
6+
Importers are responsible for scraping vulnerability data such as vulnerabilities and their fixes
7+
and for storing the scraped information in a structured fashion. The structured data created by the
8+
importer then provides input to an improver (see :ref:`improver-overview`), which is responsible
9+
for creating a relational model for vulnerabilities, affected packages and fixed packages.
910

10-
All importer implementation related code is defined in :file:`vulnerabilites/importer.py`.
11+
All importer implementation-related code is defined in :file:`vulnerabilites/importer.py`.
1112

12-
Whereas, the framework related code for actually invoking and processing the importers are
13-
situated in :file:`vulnerabilites/import_runner.py`.
13+
In addition, the framework-related code for actually invoking and processing the importers is
14+
located in :file:`vulnerabilites/import_runner.py`.
1415

15-
The importers, after scraping, provide with ``AdvisoryData`` objects. These objects are then
16+
The importers, after scraping, provide ``AdvisoryData`` objects. These objects are then
1617
processed and inserted into the ``Advisory`` model.
1718

1819
While implementing an importer, it is important to make sure that the importer does not alter the
19-
upstream data at all. Its only job is to convert the data from a data source into structured - yet
20-
non relational - data. The importers must **not** be smart or performing trickeries
21-
under the hood.
22-
This ensures that we always have a *true* copy of an advisory without any speculations or
23-
improvements.
20+
upstream data at all. Its only job is to convert the data from a data source into structured -- yet
21+
non-relational -- data. This ensures that we always have a *true* copy of an advisory without any
22+
modifications.
2423

25-
As importers do not speculate and given that a lot of advisories publish version ranges of affected
24+
Given that a lot of advisories publish version ranges of affected
2625
packages, it is necessary to store those ranges in a structured manner. *Vers* was designed to
2726
solve this problem. It has been implemented in the `univers <https://github.com/nexB/univers>`_
2827
library whose development goes hand in hand with VulnerableCode.
2928

30-
The data imported by importers is not useful by itself, it must be processed into a relational
31-
model. The version ranges are required to be dissolved into concrete ranges. These are achieved by
32-
``Improvers``. For more, see: :ref:`improver-overview`
29+
The data imported by importers is not useful by itself: it must be processed into a relational
30+
model. The version ranges are required to be resolved into concrete ranges. These are achieved by
31+
``Improvers`` (see :ref:`improver-overview` for details).
3332

34-
As of now, the following importers have been implemented in VulnerableCode
33+
As of now, the following importers have been implemented in VulnerableCode:
3534

3635
.. include:: ../../SOURCES.rst

docs/source/reference_improver_overview.rst

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -6,29 +6,29 @@ Improver Overview
66
Improvers improve upon already imported data. They are responsible for creating a relational
77
model for vulnerabilites and packages.
88

9-
An Improver is supposed to contain data points about a vulnerability and the relevant discrete
9+
An Improver is intended to contain data points about a vulnerability and the relevant discrete
1010
affected and fixed packages (in the form of `PackageURLs
1111
<https://github.com/package-url/packageurl-python>`_).
12-
There is no notion of version ranges here, all package versions must be explicitly specified.
13-
As this concrete relationship might not always be absolutely correct, improvers supply with a
12+
There is no notion of version ranges here; all package versions must be explicitly specified.
13+
As this concrete relationship might not always be absolutely correct, improvers supply a
1414
confidence score and only the record with the highest confidence against a vulnerability and package
1515
relationship is stored in the database.
1616

1717
There are two categories of improvers:
1818

1919
- **Generic**: Improve upon some imported data irrespective of any importer. These improvers are
20-
defined in :file:`vulnerabilites/improvers/`
20+
defined in :file:`vulnerabilites/improvers/`.
2121
- **Importer Specific**: Improve upon data imported by a specific importer. These are defined in the
2222
corresponding importer file itself.
2323

2424
Both types of improvers internally work in a similar fashion. They indicate which ``Advisory`` they
2525
are interested in and when supplied with those Advisories, they return Inferences.
26-
An ``Inference`` is more explicit than an ``Advisory`` and is able to answer the questions like, "Is
27-
package A vulnerable to Vulnerability B ?". Of course, there is some confidence attached with the
28-
answer which could also be ``MAX_CONFIDENCE`` in certain cases.
26+
An ``Inference`` is more explicit than an ``Advisory`` and is able to answer questions like "Is
27+
package A vulnerable to Vulnerability B ?". Of course, there is some confidence attached to the
28+
answer, which could also be ``MAX_CONFIDENCE`` in certain cases.
2929

30-
The possibilities with improvers is endless, they are not restricted to take one approach. Features
31-
like *Time Travel* and *finding fix commits* could be Implemented as well.
30+
The possibilities with improvers are endless; they are not restricted to take one approach. Features
31+
like *Time Travel* and *finding fix commits* could be implemented as well.
3232

3333
You can find more in-code documentation about improvers in :file:`vulnerabilites/improver.py` and
34-
the framework responsible for invoking these improvers in :file:`vulnerabilites/improve_runner.py`
34+
the framework responsible for invoking these improvers in :file:`vulnerabilites/improve_runner.py`.

docs/source/tutorial_add_new_importer.rst

Lines changed: 26 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,8 @@
33
Add a new importer
44
====================
55

6-
This tutorial contains all the things one should know to quickly
7-
implement an importer.
8-
A lot of internal sausage about importers could be found inside the
6+
This tutorial contains all the things one should know to quickly implement an importer.
7+
Many internal details about importers can be found inside the
98
:file:`vulnerabilites/importer.py` file.
109
Make sure to go through :ref:`importer-overview` before you begin writing one.
1110

@@ -15,7 +14,7 @@ TL;DR
1514
#. Create a new :file:`vulnerabilities/importers/{importer_name.py}` file.
1615
#. Create a new importer subclass inheriting from the ``Importer`` superclass defined in
1716
``vulnerabilites.importer``. It is conventional to end an importer name with *Importer*.
18-
#. Specify the importer licence.
17+
#. Specify the importer license.
1918
#. Implement the ``advisory_data`` method to process the data source you're writing an importer for.
2019
#. Add the newly created importer to the importers registry at
2120
``vulnerabilites/importers/__init__.py``
@@ -45,24 +44,24 @@ VulnerableCode extensively uses Package URLs to identify a package. See the
4544
AdvisoryData
4645
^^^^^^^^^^^^^
4746

48-
``AdvisoryData`` is an intermediate data-format,
49-
it is expected, that your importer converts the raw scraped data into ``AdvisoryData`` objects.
50-
All the fields in ``AdvisoryData`` dataclass are optional, it is the importer's resposibility to
51-
ensure that it must contain meaningful information about a vulnerability.
47+
``AdvisoryData`` is an intermediate data format:
48+
it is expected that your importer will convert the raw scraped data into ``AdvisoryData`` objects.
49+
All the fields in ``AdvisoryData`` dataclass are optional; it is the importer's resposibility to
50+
ensure that it contains meaningful information about a vulnerability.
5251

5352
AffectedPackage
5453
^^^^^^^^^^^^^^^^
5554

5655
``AffectedPackage`` data type is used to store a range of affected versions and a fixed version of a
57-
given package. For all version related data, `univers <https://github.com/nexB/univers>`_ library
56+
given package. For all version-related data, `univers <https://github.com/nexB/univers>`_ library
5857
is used.
5958

6059
Univers
6160
^^^^^^^^
6261

63-
`univers <https://github.com/nexB/univers>`_ is a python implementation of the `vers specification <https://github.com/package-url/purl-spec/pull/139>`_.
64-
It can parse and compare all the package versions and all the ranges.
65-
From debian, npm, pypi, ruby and more.
62+
`univers <https://github.com/nexB/univers>`_ is a Python implementation of the `vers specification <https://github.com/package-url/purl-spec/pull/139>`_.
63+
It can parse and compare all the package versions and all the ranges,
64+
from debian, npm, pypi, ruby and more.
6665
It processes all the version range specs and expressions.
6766

6867
Importer
@@ -90,24 +89,24 @@ implementing the unimplemented methods.
9089
Specify the Importer License
9190
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
9291

93-
Importers scrape data off the internet, in order to make sure the data is useable, a license must be
94-
provided.
95-
Populate the ``spdx_license_expression`` with appropriate value.
96-
The SPDX license identifies can be found at https://spdx.org/licenses/
92+
Importers scrape data off the internet. In order to make sure the data is useable, a license
93+
must be provided.
94+
Populate the ``spdx_license_expression`` with the appropriate value.
95+
The SPDX license identifiers can be found at https://spdx.org/licenses/.
9796

9897
.. note::
9998
An SPDX license identifier by itself is a valid licence expression. In case you need more complex
100-
expressions, see: https://spdx.github.io/spdx-spec/SPDX-license-expressions/
99+
expressions, see https://spdx.github.io/spdx-spec/SPDX-license-expressions/
101100

102101
Implement the ``advisory_data`` Method
103102
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
104103

105-
The ``advisory_data`` method scrapes the advisories from the data source this importer is targeted
106-
at.
107-
It is required to return an *Iterable of AdvisoryData objects*, thus it is a good idea to yield from
108-
this method after creating each AdvisoryData object
104+
The ``advisory_data`` method scrapes the advisories from the data source this importer is
105+
targeted at.
106+
It is required to return an *Iterable of AdvisoryData objects*, and thus it is a good idea to yield
107+
from this method after creating each AdvisoryData object.
109108

110-
At this point, an example importer will look like:
109+
At this point, an example importer will look like this:
111110

112111
:file:`vulnerabilites/importers/example.py`
113112

@@ -133,11 +132,11 @@ This importer is only a valid skeleton and does not import anything at all.
133132
Let us implement another dummy importer that actually imports some data.
134133

135134
Here we have a ``dummy_package`` which follows ``NginxVersionRange`` and ``SemverVersion`` for
136-
version management from `univers <https://github.com/nexB/univers>`_
135+
version management from `univers <https://github.com/nexB/univers>`_.
137136

138137
.. note::
139138

140-
It is possible that versioning scheme you are targetting has not yet been implemented in the `univers <https://github.com/nexB/univers>`_ library. If this is the case, you'll need to head over over there and implement one.
139+
It is possible that the versioning scheme you are targetting has not yet been implemented in the `univers <https://github.com/nexB/univers>`_ library. If this is the case, you'll need to head over there and implement one.
141140

142141
.. code-block:: python
143142
@@ -241,7 +240,7 @@ Congratulations! You've written your first importer.
241240
Run Your First Importer
242241
^^^^^^^^^^^^^^^^^^^^^^^^^^
243242

244-
If everything went fine, you'll see your importer in the list of available importers
243+
If everything went well, you'll see your importer in the list of available importers.
245244

246245
.. code-block:: console
247246
:emphasize-lines: 5
@@ -252,7 +251,7 @@ If everything went fine, you'll see your importer in the list of available impor
252251
vulnerabilities.importers.nginx.NginxImporter
253252
vulnerabilities.importers.example.ExampleImporter
254253
255-
Now, run the importer
254+
Now, run the importer.
256255

257256
.. code-block:: console
258257
@@ -285,7 +284,7 @@ For more visibility, turn on debug logs in :file:`vulnerablecode/settings.py`.
285284
},
286285
}
287286
288-
Invoke the import command now and you'll see (in a fresh database)
287+
Invoke the import command now and you'll see (in a fresh database):
289288

290289
.. code-block:: console
291290

0 commit comments

Comments
 (0)