vuln-microsoft – Gitea MSRC CVRF mirror

This repository mirrors raw Microsoft Security Response Center CVRF 3.0 JSON per monthly advisory document, starting in 2017. It is NOT a normalized CSAF/VEX database.

• Source: https://api.msrc.microsoft.com/cvrf/v3.0/updates
• Documents: https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/{YYYY-Mon}
• Full original source objects in data/cvrf/YYYY/YYYY-Mon.json
• Full index in data/index/updates.json
• Synchronization history/state in state/sync.json
• Gitea runner executes every 4h at minute 37 UTC; also manually via Actions.

Setup

1. Create an empty VULN/vuln-microsoft repository and push this folder as branch main.

2. On the existing Linux Gitea host runner, install git, python3, flock (util-linux) and base64 (coreutils).

3. Create the persistent folder:

   sudo install -d -o act_runner -g act_runner -m 700 /var/lib/act_runner/cache/vuln-microsoft

4. The workflow bootstraps the checkout automatically on its first run. No manual clone is needed. Ensure the runner can write to the cache path.

5. Gitea → repository → Settings → Actions: enable write permission for workflow token. secrets.GITEA_TOKEN is Gitea's native token; if your installation uses the custom GITEATOKEN, change only the workflow env line.

6. Trigger the workflow manually for the initial import.

Manual operation

python3 scripts/sync.py --since-year 2017

python3 scripts/sync.py --since-year 2017 --full (force all monthly documents to be rechecked)

python3 scripts/validate.py

Incremental behavior

The release listing is fetched every run. Missing/new documents, documents with changed release dates, and documents updated in the last 45 days are downloaded. A forced --full periodically helps reconcile older revisions whose metadata may not change. It does not delete unpublished documents automatically; deletion must be handled by a separately reviewed reconcile process.

Security: Host runners execute repository code locally on the Gitea VM; protect main and restrict workflow edit rights.