37 lines
2.1 KiB
Markdown
37 lines
2.1 KiB
Markdown
# vuln-microsoft – Gitea MSRC CVRF mirror
|
||
|
||
This repository mirrors **raw Microsoft Security Response Center CVRF 3.0 JSON** per monthly advisory document, starting in 2017. It is NOT a normalized CSAF/VEX database.
|
||
|
||
- Source: `https://api.msrc.microsoft.com/cvrf/v3.0/updates`
|
||
- Documents: `https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/{YYYY-Mon}`
|
||
- Full original source objects in `data/cvrf/YYYY/YYYY-Mon.json`
|
||
- Full index in `data/index/updates.json`
|
||
- Synchronization history/state in `state/sync.json`
|
||
- Gitea runner executes every 4h at minute 37 UTC; also manually via Actions.
|
||
|
||
## Setup
|
||
|
||
1. Create an empty `VULN/vuln-microsoft` repository and push this folder as branch `main`.
|
||
2. On the existing Linux Gitea host runner, install `git`, `python3`, `flock` (`util-linux`) and `base64` (`coreutils`).
|
||
3. Create the persistent folder:
|
||
|
||
`sudo install -d -o act_runner -g act_runner -m 700 /var/lib/act_runner/cache/vuln-microsoft`
|
||
|
||
4. The workflow bootstraps the checkout automatically on its first run. No manual clone is needed. Ensure the runner can write to the cache path.
|
||
5. Gitea → repository → Settings → Actions: enable write permission for workflow token. `secrets.GITEA_TOKEN` is Gitea's native token; if your installation uses the custom `GITEATOKEN`, change only the workflow env line.
|
||
6. Trigger the workflow manually for the initial import.
|
||
|
||
## Manual operation
|
||
|
||
`python3 scripts/sync.py --since-year 2017`
|
||
|
||
`python3 scripts/sync.py --since-year 2017 --full` (force all monthly documents to be rechecked)
|
||
|
||
`python3 scripts/validate.py`
|
||
|
||
## Incremental behavior
|
||
|
||
The release listing is fetched every run. Missing/new documents, documents with changed release dates, and documents updated in the last 45 days are downloaded. A forced `--full` periodically helps reconcile older revisions whose metadata may not change. It does **not** delete unpublished documents automatically; deletion must be handled by a separately reviewed reconcile process.
|
||
|
||
Security: Host runners execute repository code locally on the Gitea VM; protect `main` and restrict workflow edit rights.
|