scripts/validate.py aktualisiert

scripts/validate.py

@@ -12,13 +12,18 @@ def validate(root=Path('data/vex'), state=Path('state/sync.json')):
     files=sorted(root.rglob('*.json'))
     if not files or len(files)!=metadata['record_count']:
         raise ValueError(f'Count mismatch: files={len(files)} expected={metadata["record_count"]}')
+    document_only = 0
     for path in files:
         if not CVE.match(path.name):raise ValueError(f'Invalid filename: {path}')
         doc=json.loads(path.read_bytes())
-        if not isinstance(doc,dict) or not isinstance(doc.get('document'),dict) or not isinstance(doc.get('vulnerabilities'),list):
-            raise ValueError(f'Invalid CSAF VEX: {path}')
-    print(f'Validated {len(files)} CSAF VEX documents')
+        if not isinstance(doc,dict) or not isinstance(doc.get('document'),dict):
+            raise ValueError(f'Missing CSAF document object: {path}')
+        if 'vulnerabilities' in doc and not isinstance(doc['vulnerabilities'],list):
+            raise ValueError(f'Invalid vulnerabilities field: {path}')
+        if 'vulnerabilities' not in doc:
+            document_only += 1
+    print(f'Validated {len(files)} CSAF documents ({document_only} without vulnerabilities; not verified as VEX-profile conformant)')
 if __name__=='__main__':
     try:validate()
     except (ValueError,OSError,KeyError,json.JSONDecodeError) as ex:
-        print(f'VALIDATION FAILED: {ex}',file=sys.stderr);sys.exit(1)
+        print(f'VALIDATION FAILED: {ex}',file=sys.stderr);sys.exit(1)