Skip to content

Commit d0dd5b3

Browse files
committed
Implement initial set of RTD updates #885 #886 #887 #888
Reference: #885 Reference: #886 Reference: #887 Reference: #888 Signed-off-by: John M. Horan <[email protected]>
1 parent d72c3b9 commit d0dd5b3

9 files changed

+89
-86
lines changed

docs/source/command-line-interface.rst

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ Command Line Interface
66
The main entry point is Django's :guilabel:`manage.py` management commands.
77

88
``$ ./manage.py --help``
9-
-----------------------
9+
------------------------
1010

1111
Lists all sub-commands available, including Django built-in commands.
1212
VulnerableCode's own commands are listed under the ``[vulnerabilities]`` section::

docs/source/conf.py

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,8 @@
1818
# -- Project information -----------------------------------------------------
1919

2020
project = "VulnerableCode"
21-
copyright = "nexb Inc. and others"
22-
author = "nexb Inc. and others"
21+
copyright = "nexB Inc. and others"
22+
author = "nexB Inc. and others"
2323

2424

2525
# -- General configuration ---------------------------------------------------

docs/source/importers_link.rst

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
.. _importers_link:
2+
3+
Importers
4+
=========
5+
6+
.. include:: ../../SOURCES.rst

docs/source/installation.rst

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@ Local development installation
109109
Supported Platforms
110110
^^^^^^^^^^^^^^^^^^^
111111

112-
**VulnerableCode* has been tested and is supported on the following operating systems:
112+
**VulnerableCode** has been tested and is supported on the following operating systems:
113113

114114
#. **Debian-based** Linux distributions
115115
#. **macOS** 12.1 and up
@@ -122,7 +122,7 @@ Pre-installation Checklist
122122

123123
Before you install VulnerableCode, make sure you have the following prerequisites:
124124

125-
* **Python: 3.8+* found at https://www.python.org/downloads/
125+
* **Python: 3.8+** found at https://www.python.org/downloads/
126126
* **Git**: most recent release available at https://git-scm.com/
127127
* **PostgreSQL**: release 10 or later found at https://www.postgresql.org/ or
128128
https://postgresapp.com/ on macOS
@@ -212,8 +212,6 @@ application.
212212
This setup is **not suitable for deployments** and **only supported for local
213213
development**.
214214

215-
An overview of the web application usage is available at :ref:`user_interface`.
216-
217215

218216
Upgrading
219217
^^^^^^^^^

docs/source/introduction.rst

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ How does it work ?
3232

3333
VulnerableCode independently aggregates many software vulnerability data sources
3434
and supports data re-creation in a decentralized fashion. These data sources
35-
(see complete list `here <./SOURCES.rst>`_) include security advisories
35+
(see complete list :ref:`here <importers_link>`) include security advisories
3636
published by Linux and BSD distributions, application software package managers
3737
and package repositories, FOSS projects, GitHub and more. Thanks to this
3838
approach, the data is focused on specific ecosystems yet aggregated in a single

docs/source/reference_importer_overview.rst

Lines changed: 16 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -3,34 +3,33 @@
33
Importer Overview
44
==================
55

6-
Importers are responsible to scrape vulnerability data from various data sources without creating
7-
a complete relational model between vulnerabilites, their fixes and store them in a structured
8-
fashion.
6+
Importers are responsible for scraping vulnerability data such as vulnerabilities and their fixes and
7+
for storing the scraped information in a structured fashion. The structured data created by the
8+
importer then provides input to an improver (see :ref:`improver-overview`), which is responsible
9+
for creating a relational model for vulnerabilities, affected packages and fixed packages.
910

10-
All importer implementation related code is defined in :file:`vulnerabilites/importer.py`.
11+
All importer implementation-related code is defined in :file:`vulnerabilites/importer.py`.
1112

12-
Whereas, the framework related code for actually invoking and processing the importers are
13-
situated in :file:`vulnerabilites/import_runner.py`.
13+
In addition, the framework-related code for actually invoking and processing the importers is
14+
located in :file:`vulnerabilites/import_runner.py`.
1415

15-
The importers, after scraping, provide with ``AdvisoryData`` objects. These objects are then
16+
The importers, after scraping, provide ``AdvisoryData`` objects. These objects are then
1617
processed and inserted into the ``Advisory`` model.
1718

1819
While implementing an importer, it is important to make sure that the importer does not alter the
19-
upstream data at all. Its only job is to convert the data from a data source into structured - yet
20-
non relational - data. The importers must **not** be smart or performing trickeries
21-
under the hood.
22-
This ensures that we always have a *true* copy of an advisory without any speculations or
23-
improvements.
20+
upstream data at all. Its only job is to convert the data from a data source into structured -- yet
21+
non-relational -- data. This ensures that we always have a *true* copy of an advisory without any
22+
modifications.
2423

25-
As importers do not speculate and given that a lot of advisories publish version ranges of affected
24+
Given that a lot of advisories publish version ranges of affected
2625
packages, it is necessary to store those ranges in a structured manner. *Vers* was designed to
2726
solve this problem. It has been implemented in the `univers <https://github.com/nexB/univers>`_
2827
library whose development goes hand in hand with VulnerableCode.
2928

30-
The data imported by importers is not useful by itself, it must be processed into a relational
31-
model. The version ranges are required to be dissolved into concrete ranges. These are achieved by
32-
``Improvers``. For more, see: :ref:`improver-overview`
29+
The data imported by importers is not useful by itself: it must be processed into a relational
30+
model. The version ranges are required to be resolved into concrete ranges. These are achieved by
31+
``Improvers`` (see :ref:`improver-overview` for details).
3332

34-
As of now, the following importers have been implemented in VulnerableCode
33+
As of now, the following importers have been implemented in VulnerableCode:
3534

3635
.. include:: ../../SOURCES.rst

docs/source/reference_improver_overview.rst

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -6,29 +6,29 @@ Improver Overview
66
Improvers improve upon already imported data. They are responsible for creating a relational
77
model for vulnerabilites and packages.
88

9-
An Improver is supposed to contain data points about a vulnerability and the relevant discrete
9+
An Improver is intended to contain data points about a vulnerability and the relevant discrete
1010
affected and fixed packages (in the form of `PackageURLs
1111
<https://github.com/package-url/packageurl-python>`_).
12-
There is no notion of version ranges here, all package versions must be explicitly specified.
13-
As this concrete relationship might not always be absolutely correct, improvers supply with a
12+
There is no notion of version ranges here; all package versions must be explicitly specified.
13+
As this concrete relationship might not always be absolutely correct, improvers supply a
1414
confidence score and only the record with the highest confidence against a vulnerability and package
1515
relationship is stored in the database.
1616

1717
There are two categories of improvers:
1818

1919
- **Generic**: Improve upon some imported data irrespective of any importer. These improvers are
20-
defined in :file:`vulnerabilites/improvers/`
20+
defined in :file:`vulnerabilites/improvers/`.
2121
- **Importer Specific**: Improve upon data imported by a specific importer. These are defined in the
2222
corresponding importer file itself.
2323

2424
Both types of improvers internally work in a similar fashion. They indicate which ``Advisory`` they
2525
are interested in and when supplied with those Advisories, they return Inferences.
26-
An ``Inference`` is more explicit than an ``Advisory`` and is able to answer the questions like, "Is
27-
package A vulnerable to Vulnerability B ?". Of course, there is some confidence attached with the
28-
answer which could also be ``MAX_CONFIDENCE`` in certain cases.
26+
An ``Inference`` is more explicit than an ``Advisory`` and is able to answer questions like "Is
27+
package A vulnerable to Vulnerability B ?". Of course, there is some confidence attached to the
28+
answer, which could also be ``MAX_CONFIDENCE`` in certain cases.
2929

30-
The possibilities with improvers is endless, they are not restricted to take one approach. Features
31-
like *Time Travel* and *finding fix commits* could be Implemented as well.
30+
The possibilities with improvers are endless; they are not restricted to take one approach. Features
31+
like *Time Travel* and *finding fix commits* could be implemented as well.
3232

3333
You can find more in-code documentation about improvers in :file:`vulnerabilites/improver.py` and
34-
the framework responsible for invoking these improvers in :file:`vulnerabilites/improve_runner.py`
34+
the framework responsible for invoking these improvers in :file:`vulnerabilites/improve_runner.py`.

docs/source/tutorial_add_new_importer.rst

Lines changed: 22 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ Add a new importer
55

66
This tutorial contains all the things one should know to quickly
77
implement an importer.
8-
A lot of internal sausage about importers could be found inside the
8+
Many internal details about importers can be found inside the
99
:file:`vulnerabilites/importer.py` file.
1010
Make sure to go through :ref:`importer-overview` before you begin writing one.
1111

@@ -15,7 +15,7 @@ TL;DR
1515
#. Create a new :file:`vulnerabilities/importers/{importer_name.py}` file.
1616
#. Create a new importer subclass inheriting from the ``Importer`` superclass defined in
1717
``vulnerabilites.importer``. It is conventional to end an importer name with *Importer*.
18-
#. Specify the importer licence.
18+
#. Specify the importer license.
1919
#. Implement the ``advisory_data`` method to process the data source you're writing an importer for.
2020
#. Add the newly created importer to the importers registry at
2121
``vulnerabilites/importers/__init__.py``
@@ -45,24 +45,24 @@ VulnerableCode extensively uses Package URLs to identify a package. See the
4545
AdvisoryData
4646
^^^^^^^^^^^^^
4747

48-
``AdvisoryData`` is an intermediate data-format,
49-
it is expected, that your importer converts the raw scraped data into ``AdvisoryData`` objects.
50-
All the fields in ``AdvisoryData`` dataclass are optional, it is the importer's resposibility to
51-
ensure that it must contain meaningful information about a vulnerability.
48+
``AdvisoryData`` is an intermediate data format:
49+
it is expected that your importer will convert the raw scraped data into ``AdvisoryData`` objects.
50+
All the fields in ``AdvisoryData`` dataclass are optional; it is the importer's resposibility to
51+
ensure that it contains meaningful information about a vulnerability.
5252

5353
AffectedPackage
5454
^^^^^^^^^^^^^^^^
5555

5656
``AffectedPackage`` data type is used to store a range of affected versions and a fixed version of a
57-
given package. For all version related data, `univers <https://github.com/nexB/univers>`_ library
57+
given package. For all version-related data, `univers <https://github.com/nexB/univers>`_ library
5858
is used.
5959

6060
Univers
6161
^^^^^^^^
6262

63-
`univers <https://github.com/nexB/univers>`_ is a python implementation of the `vers specification <https://github.com/package-url/purl-spec/pull/139>`_.
64-
It can parse and compare all the package versions and all the ranges.
65-
From debian, npm, pypi, ruby and more.
63+
`univers <https://github.com/nexB/univers>`_ is a Python implementation of the `vers specification <https://github.com/package-url/purl-spec/pull/139>`_.
64+
It can parse and compare all the package versions and all the ranges,
65+
from debian, npm, pypi, ruby and more.
6666
It processes all the version range specs and expressions.
6767

6868
Importer
@@ -90,24 +90,24 @@ implementing the unimplemented methods.
9090
Specify the Importer License
9191
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
9292

93-
Importers scrape data off the internet, in order to make sure the data is useable, a license must be
93+
Importers scrape data off the internet. In order to make sure the data is useable, a license must be
9494
provided.
95-
Populate the ``spdx_license_expression`` with appropriate value.
96-
The SPDX license identifies can be found at https://spdx.org/licenses/
95+
Populate the ``spdx_license_expression`` with the appropriate value.
96+
The SPDX license identifiers can be found at https://spdx.org/licenses/.
9797

9898
.. note::
9999
An SPDX license identifier by itself is a valid licence expression. In case you need more complex
100-
expressions, see: https://spdx.github.io/spdx-spec/SPDX-license-expressions/
100+
expressions, see https://spdx.github.io/spdx-spec/SPDX-license-expressions/
101101

102102
Implement the ``advisory_data`` Method
103103
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
104104

105105
The ``advisory_data`` method scrapes the advisories from the data source this importer is targeted
106106
at.
107-
It is required to return an *Iterable of AdvisoryData objects*, thus it is a good idea to yield from
108-
this method after creating each AdvisoryData object
107+
It is required to return an *Iterable of AdvisoryData objects*, and thus it is a good idea to yield from
108+
this method after creating each AdvisoryData object.
109109

110-
At this point, an example importer will look like:
110+
At this point, an example importer will look like this:
111111

112112
:file:`vulnerabilites/importers/example.py`
113113

@@ -133,11 +133,11 @@ This importer is only a valid skeleton and does not import anything at all.
133133
Let us implement another dummy importer that actually imports some data.
134134

135135
Here we have a ``dummy_package`` which follows ``NginxVersionRange`` and ``SemverVersion`` for
136-
version management from `univers <https://github.com/nexB/univers>`_
136+
version management from `univers <https://github.com/nexB/univers>`_.
137137

138138
.. note::
139139

140-
It is possible that versioning scheme you are targetting has not yet been implemented in the `univers <https://github.com/nexB/univers>`_ library. If this is the case, you'll need to head over over there and implement one.
140+
It is possible that the versioning scheme you are targetting has not yet been implemented in the `univers <https://github.com/nexB/univers>`_ library. If this is the case, you'll need to head over there and implement one.
141141

142142
.. code-block:: python
143143
@@ -241,7 +241,7 @@ Congratulations! You've written your first importer.
241241
Run Your First Importer
242242
^^^^^^^^^^^^^^^^^^^^^^^^^^
243243

244-
If everything went fine, you'll see your importer in the list of available importers
244+
If everything went well, you'll see your importer in the list of available importers.
245245

246246
.. code-block:: console
247247
:emphasize-lines: 5
@@ -252,7 +252,7 @@ If everything went fine, you'll see your importer in the list of available impor
252252
vulnerabilities.importers.nginx.NginxImporter
253253
vulnerabilities.importers.example.ExampleImporter
254254
255-
Now, run the importer
255+
Now, run the importer.
256256

257257
.. code-block:: console
258258
@@ -285,7 +285,7 @@ For more visibility, turn on debug logs in :file:`vulnerablecode/settings.py`.
285285
},
286286
}
287287
288-
Invoke the import command now and you'll see (in a fresh database)
288+
Invoke the import command now and you'll see (in a fresh database):
289289

290290
.. code-block:: console
291291

0 commit comments

Comments
 (0)