Initial Microsoft MSRC mirror

2026-11-10 21:06:18 +01:00
commit 88dbaef361
7 changed files with 286 additions and 0 deletions
@@ -0,0 +1,36 @@
+# vuln-microsoft – Gitea MSRC CVRF mirror
+
+This repository mirrors **raw Microsoft Security Response Center CVRF 3.0 JSON** per monthly advisory document, starting in 2017. It is NOT a normalized CSAF/VEX database.
+
+- Source: `https://api.msrc.microsoft.com/cvrf/v3.0/updates`
+- Documents: `https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/{YYYY-Mon}`
+- Full original source objects in `data/cvrf/YYYY/YYYY-Mon.json`
+- Full index in `data/index/updates.json`
+- Synchronization history/state in `state/sync.json`
+- Gitea runner executes every 4h at minute 37 UTC; also manually via Actions.
+
+## Setup
+
+1. Create an empty `VULN/vuln-microsoft` repository and push this folder as branch `main`.
+2. On the existing Linux Gitea host runner, install `git`, `python3`, `flock` (`util-linux`) and `base64` (`coreutils`).
+3. Create the persistent folder:
+
+   `sudo install -d -o act_runner -g act_runner -m 700 /var/lib/act_runner/cache/vuln-microsoft`
+
+4. The workflow bootstraps the checkout automatically on its first run. No manual clone is needed. Ensure the runner can write to the cache path.
+5. Gitea → repository → Settings → Actions: enable write permission for workflow token. `secrets.GITEA_TOKEN` is Gitea's native token; if your installation uses the custom `GITEATOKEN`, change only the workflow env line.
+6. Trigger the workflow manually for the initial import.
+
+## Manual operation
+
+`python3 scripts/sync.py --since-year 2017`
+
+`python3 scripts/sync.py --since-year 2017 --full`   (force all monthly documents to be rechecked)
+
+`python3 scripts/validate.py`
+
+## Incremental behavior
+
+The release listing is fetched every run. Missing/new documents, documents with changed release dates, and documents updated in the last 45 days are downloaded. A forced `--full` periodically helps reconcile older revisions whose metadata may not change. It does **not** delete unpublished documents automatically; deletion must be handled by a separately reviewed reconcile process.
+
+Security: Host runners execute repository code locally on the Gitea VM; protect `main` and restrict workflow edit rights.