{"id":19230530,"url":"https://github.com/ctron/csaf-walker","last_synced_at":"2025-04-21T03:31:07.068Z","repository":{"id":162084739,"uuid":"636704215","full_name":"ctron/csaf-walker","owner":"ctron","description":"A library and CLI to work with CSAF and SBOM data","archived":false,"fork":false,"pushed_at":"2025-04-09T08:33:59.000Z","size":1896,"stargazers_count":5,"open_issues_count":4,"forks_count":6,"subscribers_count":4,"default_branch":"main","last_synced_at":"2025-04-09T08:39:18.883Z","etag":null,"topics":["csaf","cyclonedx-sbom","sbom","software-supply-chain-security","spdx-sbom","vex"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ctron.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-05-05T13:01:11.000Z","updated_at":"2025-04-07T11:37:17.000Z","dependencies_parsed_at":"2023-10-02T07:56:16.273Z","dependency_job_id":"5a6a3ac8-838e-448d-a32b-7582acb80859","html_url":"https://github.com/ctron/csaf-walker","commit_stats":null,"previous_names":[],"tags_count":86,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ctron%2Fcsaf-walker","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ctron%2Fcsaf-walker/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ctron%2Fcsaf-walker/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ctron%2Fcsaf-walker/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ctron","download_url":"https://codeload.github.com/ctron/csaf-walker/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":249990908,"owners_count":21357168,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["csaf","cyclonedx-sbom","sbom","software-supply-chain-security","spdx-sbom","vex"],"created_at":"2024-11-09T15:39:44.455Z","updated_at":"2025-04-21T03:31:05.889Z","avatar_url":"https://github.com/ctron.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# CSAF Walker\n\n[![crates.io](https://img.shields.io/crates/v/csaf-walker.svg)](https://crates.io/crates/csaf-walker)\n[![docs.rs](https://docs.rs/csaf-walker/badge.svg)](https://docs.rs/csaf-walker)\n[![GitHub release (latest SemVer)](https://img.shields.io/github/v/tag/ctron/csaf-walker?sort=semver)](https://github.com/ctron/csaf-walker/releases)\n[![CI](https://github.com/ctron/csaf-walker/workflows/CI/badge.svg)](https://github.com/ctron/csaf-walker/actions?query=workflow%3A%22CI%22)\n\n\"Walk\" CSAF data from a remote server, allowing one to work with the data.\n\nIn addition, this repository also has a tool for working with SBOM data. Most of the options explained are valid for\nboth SBOM and CSAF.\n\n## From the command line\n\nThere's a command line tool, which can be used right away.\n\n### Installation\n\nDownload a ready-to-run binary from the GitHub release page: \u003chttps://github.com/ctron/csaf-walker/releases\u003e\n\nYou can also use `cargo binstall` to install such a binary:\n\n```shell\ncargo binstall csaf-cli\ncargo binstall sbom-cli\n```\n\nOr compile it yourself, using plain `cargo install`:\n\n```shell\ncargo install csaf-cli\ncargo install sbom-cli\n```\n\n### Usage\n\nYou can download all documents by providing a domain of the CSAF trusted provider:\n\n```shell\nmkdir out\ncsaf sync -3 -v -d out/ redhat.com\n```\n\nIt is also possible to only download files, skipping the validation step (which can be done later using an already\ndownloaded copy):\n\n```shell\nmkdir out\ncsaf download -3 -v -d out/ redhat.com\n```\n\n\u003e [!NOTE]\n\u003e In cases where data is signed with a GPG v3 signature, you can use the `-3` flag, which considers this still valid.\n\u003e\n\u003e An alternative is to use the `--policy-date` argument, and provide a manual policy date. Also\n\u003e see: \u003chttps://docs.sequoia-pgp.org/sequoia_openpgp/policy/struct.StandardPolicy.html\u003e.\n\n### Differential sync\n\nBy default, timestamps reported by the HTTP server will be applied to the downloaded files. When re-running, the\n`changes.csv` file will be used as a source to discover when a file was changed. If a file is already present and has\na newer modification timestamp in the `changes.csv` file, then it will be downloaded again. Otherwise, it will be\nskipped.\n\nUsing the `--since` option, it is possible to provide a start timestamp, which will skip all changes reported before\nthis timestamp, and force all changes after this timestamp (independent of the file local file timestamp) to be\nre-synced.\n\nUsing the `--since-file` option, it is possible to automate the \"since\" value, by initially loading the \"since\" value\nfrom a file, and storing it into a file at the end of a successful run. The timestamp stored will be the timestamp,\nwhen the application started processing.\n\nIf both `--since` and `--since-file` are provided, then the \"since file\" will be used first, and the \"since\" value will\nact as a fallback if the file is not present.\n\n### Sending data\n\nInstead of storing, it is also possible to send data to a remote instance (using the Vexination or Bombastic API).\n\n```shell\ncsaf send -3 redhat.com http://localhost:8083\n```\n\nOf course, it is also possible to use the filesystem as a source:\n\n```shell\ncsaf send -3 file:out/ http://localhost:8083\n```\n\n## As a library\n\nUsing the crate `csaf-walker`, this can also be used as a library:\n\n```rust\nuse anyhow::Result;\nuse url::Url;\nuse csaf_walker::source::HttpSource;\nuse csaf_walker::walker::Walker;\nuse csaf_walker::retrieve::RetrievingVisitor;\nuse csaf_walker::validation::{ValidatedAdvisory, ValidationError, ValidationVisitor};\nuse walker_common::fetcher::Fetcher;\n\nasync fn walk() -\u003e Result\u003c()\u003e {\n    let fetcher = Fetcher::new(Default::default()).await?;\n    let metadata = MetadataRetriever::new(\"redhat.com\");\n    let source = HttpSource::new(metadata, fetcher, Default::default());\n\n    Walker::new(source.clone())\n        .walk(RetrievingVisitor::new(\n            source.clone(),\n            ValidationVisitor::new(\n                move |advisory: Result\u003cValidatedAdvisory, ValidationError\u003e| async move {\n                    log::info!(\"Found advisory: {advisory:?}\");\n                    Ok::\u003c_, anyhow::Error\u003e(())\n                },\n            )\n        ))\n        .await?;\n\n    Ok(())\n}\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fctron%2Fcsaf-walker","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fctron%2Fcsaf-walker","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fctron%2Fcsaf-walker/lists"}