Initial Ubuntu security mirror

scripts/run-cached.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+umask 077
+: "${GITEA_JOB_TOKEN:?GITEA_JOB_TOKEN fehlt}"
+CACHE_ROOT="${CACHE_ROOT:-/var/lib/act_runner/cache/vuln-ubuntu}"
+REPO_URL="${REPO_URL:-https://git.apex-project.de/VULN/vuln-ubuntu.git}"
+mkdir -p "$CACHE_ROOT"
+exec 9>"$CACHE_ROOT/.sync.lock"
+flock -w 300 9 || { echo 'Schon ein anderer Lauf aktiv' >&2; exit 1; }
+cd "$CACHE_ROOT"
+if [[ ! -d repo/.git ]]; then
+  [[ ! -e repo ]] || { echo 'repo existiert ohne gültiges Git-Verzeichnis' >&2; exit 1; }
+  git -c "http.extraHeader=$AUTH_HEADER" clone --depth 1 "$REPO_URL" repo
+fi
+cd repo
+# No credentials written to disk. Authentication is supplied on individual
+# Git requests through an HTTP header.
+AUTH_HEADER="Authorization: Basic $(printf 'oauth2:%s' "$GITEA_JOB_TOKEN" | base64 -w0)"
+git -c "http.extraHeader=$AUTH_HEADER" fetch --depth 1 origin main
+git checkout -B main FETCH_HEAD
+git reset --hard FETCH_HEAD
+# Keep the large upstream checkout outside the Gitea repository.
+python3 scripts/sync.py --upstream-cache "$CACHE_ROOT/upstream" --since-year 2017
+python3 scripts/validate.py
+git add -A data state
+if git diff --cached --quiet; then
+  echo 'Keine Rohdaten-Änderungen'
+  exit 0
+fi
+git -c user.name='Vulnerability Bot' -c user.email='vulnerability-bot@localhost.invalid' \
+  commit -m "Update Ubuntu OSV $(date -u +%Y-%m-%dT%H:%M:%SZ)"
+git -c "http.extraHeader=$AUTH_HEADER" push origin HEAD:main