# vuln-microsoft – Gitea MSRC CVRF mirror

This repository mirrors **raw Microsoft Security Response Center CVRF 3.0 JSON** per monthly advisory document, starting in 2017. It is NOT a normalized CSAF/VEX database.

- Source: `https://api.msrc.microsoft.com/cvrf/v3.0/updates`
- Documents: `https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/{YYYY-Mon}`
- Full original source objects in `data/cvrf/YYYY/YYYY-Mon.json`
- Full index in `data/index/updates.json`
- Synchronization history/state in `state/sync.json`
- Gitea runner executes every 4h at minute 37 UTC; also manually via Actions.

## Setup

1. Create an empty `VULN/vuln-microsoft` repository and push this folder as branch `main`.
2. On the existing Linux Gitea host runner, install `git`, `python3`, `flock` (`util-linux`) and `base64` (`coreutils`).
3. Create the persistent folder:

   `sudo install -d -o act_runner -g act_runner -m 700 /var/lib/act_runner/cache/vuln-microsoft`

4. The workflow bootstraps the checkout automatically on its first run. No manual clone is needed. Ensure the runner can write to the cache path.
5. Gitea → repository → Settings → Actions: enable write permission for workflow token. `secrets.GITEA_TOKEN` is Gitea's native token; if your installation uses the custom `GITEATOKEN`, change only the workflow env line.
6. Trigger the workflow manually for the initial import.

## Manual operation

`python3 scripts/sync.py --since-year 2017`

`python3 scripts/sync.py --since-year 2017 --full`   (force all monthly documents to be rechecked)

`python3 scripts/validate.py`

## Incremental behavior

The release listing is fetched every run. Missing/new documents, documents with changed release dates, and documents updated in the last 45 days are downloaded. A forced `--full` periodically helps reconcile older revisions whose metadata may not change. It does **not** delete unpublished documents automatically; deletion must be handled by a separately reviewed reconcile process.

Security: Host runners execute repository code locally on the Gitea VM; protect `main` and restrict workflow edit rights.