29 lines
1.4 KiB
Python
29 lines
1.4 KiB
Python
#!/usr/bin/env python3
|
|
"""Fail closed on invalid CSAF JSON and incomplete synchronization."""
|
|
import json
|
|
from pathlib import Path
|
|
import re
|
|
import sys
|
|
|
|
CVE=re.compile(r'^CVE-\d{4}-\d{4,}\.json$',re.I)
|
|
def validate(root=Path('data/vex'), state=Path('state/sync.json')):
|
|
if not state.exists():raise ValueError('Missing completed sync state')
|
|
metadata=json.loads(state.read_text())
|
|
files=sorted(root.rglob('*.json'))
|
|
if not files or len(files)!=metadata['record_count']:
|
|
raise ValueError(f'Count mismatch: files={len(files)} expected={metadata["record_count"]}')
|
|
document_only = 0
|
|
for path in files:
|
|
if not CVE.match(path.name):raise ValueError(f'Invalid filename: {path}')
|
|
doc=json.loads(path.read_bytes())
|
|
if not isinstance(doc,dict) or not isinstance(doc.get('document'),dict):
|
|
raise ValueError(f'Missing CSAF document object: {path}')
|
|
if 'vulnerabilities' in doc and not isinstance(doc['vulnerabilities'],list):
|
|
raise ValueError(f'Invalid vulnerabilities field: {path}')
|
|
if 'vulnerabilities' not in doc:
|
|
document_only += 1
|
|
print(f'Validated {len(files)} CSAF documents ({document_only} without vulnerabilities; not verified as VEX-profile conformant)')
|
|
if __name__=='__main__':
|
|
try:validate()
|
|
except (ValueError,OSError,KeyError,json.JSONDecodeError) as ex:
|
|
print(f'VALIDATION FAILED: {ex}',file=sys.stderr);sys.exit(1) |