feat(eol): added eol dates

.github/workflows/update.yml

@@ -107,6 +107,10 @@ jobs:
       name: Go Vulnerability Database
       run: ./vuln-list-update -target go-vulndb
 
+    - if: always()
+      name: EOL Dates
+      run: ./vuln-list-update -target eol
+
     # Red Hat Security Data API is unstable.
     # It should be split into small pieces to reduce the impact of failure.
     - if: always()

eol/alma/alma.go

@@ -0,0 +1,101 @@
+package alma
+
+import (
+	"fmt"
+	"path/filepath"
+	"strings"
+	"time"
+
+	eolutils "github.com/aquasecurity/vuln-list-update/eol/utils"
+	"github.com/aquasecurity/vuln-list-update/utils"
+	"github.com/spf13/afero"
+	"golang.org/x/xerrors"
+)
+
+const (
+	baseUrl  = "https://endoflife.date/api/%s.json"
+	distName = "AlmaLinux"
+	dirPath  = "eol/alma"
+	fileName = "alma.json"
+	retry    = 3
+)
+
+type options struct {
+	url         string
+	vulnListDir string
+	retry       int
+	appFs       afero.Fs
+}
+
+type option func(*options)
+
+func WithURL(url string) option {
+	return func(opts *options) { opts.url = url }
+}
+
+func WithVulnListDir(vulnListDir string) option {
+	return func(opts *options) { opts.vulnListDir = vulnListDir }
+}
+
+func WithRetry(retry int) option {
+	return func(opts *options) { opts.retry = retry }
+}
+
+type Config struct {
+	*options
+}
+
+func NewConfig(opts ...option) Config {
+	o := &options{
+		url:         fmt.Sprintf(baseUrl, strings.ToLower(distName)),
+		vulnListDir: utils.VulnListDir(),
+		retry:       retry,
+		appFs:       afero.NewOsFs(),
+	}
+
+	for _, opt := range opts {
+		opt(o)
+	}
+
+	return Config{
+		options: o,
+	}
+}
+
+func (c Config) Name() string {
+	return distName
+}
+
+func (c Config) Update() error {
+	eolDates := map[string]time.Time{}
+
+	cycles, err := eolutils.GetLifeCycles(distName, c.url, c.retry)
+	if err != nil {
+		return xerrors.Errorf("unable to get EOL dates from %s, err: %w ", c.url, err)
+	}
+
+	for _, cycle := range cycles {
+		if eol, ok := cycle.Eol.(string); ok {
+			d, err := time.Parse("2006-01-02", eol)
+			if err != nil {
+				return xerrors.Errorf("unable to parse %q date: %w", cycle.Eol, err)
+			}
+			eolDates[cycle.Cycle] = d
+		}
+	}
+
+	if len(eolDates) == 0 {
+		return xerrors.Errorf("list of end-of-life dates is empty")
+	}
+
+	return c.save(eolDates)
+}
+
+func (c Config) save(dates map[string]time.Time) error {
+	dir := filepath.Join(c.vulnListDir, dirPath)
+
+	if err := utils.WriteJSON(c.appFs, dir, fileName, dates); err != nil {
+		return xerrors.Errorf("failed to write %s under %s: %w", fileName, dirPath, err)
+	}
+	return nil
+}

eol/alma/alma_test.go

@@ -0,0 +1,77 @@
+package alma
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestConfig_Update(t *testing.T) {
+	tests := []struct {
+		name       string
+		filepath   string
+		goldenPath string
+		wantErr    string
+	}{
+		{
+			name:       "happy path",
+			filepath:   "testdata/happy.json",
+			goldenPath: "testdata/golden.json",
+		},
+		{
+			name:    "sad path. 404",
+			wantErr: "failed to get list of end-of-life dates from url: failed to fetch URL",
+		},
+		{
+			name:     "sad path. Empty json has been returned",
+			filepath: "testdata/empty.json",
+			wantErr:  "list of end-of-life dates is empty",
+		},
+		{
+			name:     "sad path. Bad json has been returned",
+			filepath: "testdata/sad.json",
+			wantErr:  "unable to get EOL dates from",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if test.filepath != "" {
+					http.ServeFile(w, r, test.filepath)
+				} else {
+					w.WriteHeader(http.StatusNotFound)
+				}
+			}))
+			defer ts.Close()
+
+			tmpDir, _ := os.MkdirTemp("", "eol-"+distName)
+			filePath := filepath.Join(tmpDir, dirPath, fileName)
+
+			c := NewConfig(WithVulnListDir(tmpDir), WithURL(ts.URL), WithRetry(1))
+
+			err := c.Update()
+
+			if test.wantErr != "" {
+				assert.NotNil(t, err)
+				assert.NoFileExists(t, filePath)
+				assert.ErrorContains(t, err, test.wantErr)
+			} else {
+				assert.Nil(t, err)
+				assert.FileExists(t, filePath)
+
+				gotJson, err := os.ReadFile(filePath)
+				assert.NoError(t, err)
+
+				wantJson, err := os.ReadFile(test.goldenPath)
+				assert.NoError(t, err)
+
+				assert.JSONEq(t, string(wantJson), string(gotJson))
+			}
+		})
+	}
+}

eol/alma/testdata/empty.json

@@ -0,0 +1,4 @@
+[
+  {
+  }
+]

eol/alma/testdata/golden.json

@@ -0,0 +1,3 @@
+{
+  "8": "2029-03-01T00:00:00Z"
+}

eol/alma/testdata/happy.json

@@ -0,0 +1,10 @@
+[
+  {
+    "cycle": "8",
+    "release": "2019-05-01",
+    "support": "2024-05-01",
+    "eol": "2029-03-01",
+    "latest": "8.5",
+    "link": "https://mirrors.almalinux.org/isos.html"
+  }
+]

eol/alma/testdata/sad.json

@@ -0,0 +1,9 @@
+[
+  {
+    "cycle": "8",
+    "release": "2019-05-01",
+    "support": "2024-05-01",
+    "eol": "2029-03-01",
+    "latest": "8.5",
+    "link": "https://mirrors.almalinux.org/isos.html"
+  }

eol/alpine/alpine.go

@@ -0,0 +1,128 @@
+package alpine
+
+import (
+	"bytes"
+	"log"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/PuerkitoBio/goquery"
+	eolutils "github.com/aquasecurity/vuln-list-update/eol/utils"
+	"github.com/aquasecurity/vuln-list-update/utils"
+	"github.com/spf13/afero"
+	"golang.org/x/xerrors"
+)
+
+const (
+	distName        = "alpine"
+	eolAlpineFolder = "eol/alpine"
+	eolAlpineFile   = "alpine.json"
+	eolAlpineUrl    = "https://alpinelinux.org/releases/"
+	retry           = 5
+)
+
+type Config struct {
+	vulnListDir string
+	eolUrl      string
+	retry       int
+	appFs       afero.Fs
+}
+
+type Option func(c *Config)
+
+func WithVulnListDir(v string) Option {
+	return func(c *Config) { c.vulnListDir = v }
+}
+
+func WithEolURL(v string) Option {
+	return func(c *Config) { c.eolUrl = v }
+}
+
+func WithRetry(v int) Option {
+	return func(c *Config) { c.retry = v }
+}
+
+func NewConfig(options ...Option) *Config {
+	c := &Config{
+		vulnListDir: utils.VulnListDir(),
+		eolUrl:      eolAlpineUrl,
+		retry:       retry,
+		appFs:       afero.NewOsFs(),
+	}
+	for _, option := range options {
+		option(c)
+	}
+	return c
+}
+
+func (c Config) Name() string {
+	return distName
+}
+
+func (c Config) Update() error {
+	dates, err := c.getEOFDates()
+	if err != nil {
+		return err
+	}
+
+	err = c.save(dates)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (c Config) getEOFDates() (map[string]time.Time, error) {
+	eolDates := make(map[string]time.Time)
+
+	log.Println("Fetching Alpine end-of-life dates...")
+	b, err := utils.FetchURL(c.eolUrl, "", c.retry)
+	if err != nil {
+		return nil, xerrors.Errorf("failed to get list of end-of-life dates from url: %w", err)
+	}
+
+	doc, err := goquery.NewDocumentFromReader(bytes.NewReader(b))
+	if err != nil {
+		return nil, xerrors.Errorf("failed to read list of end-of-life dates: %w", err)
+	}
+
+	doc.Find("tbody tr").Each(func(_ int, tr *goquery.Selection) {
+		var version string
+		var date time.Time
+
+		tr.Find("td").Each(func(ix int, td *goquery.Selection) {
+			switch ix {
+			case 0:
+				version = strings.TrimPrefix(td.Text(), "v") // remove 'v' prefix
+			case 4:
+				d, err := time.Parse("2006-01-02", td.Text())
+				if err != nil {
+					return
+				}
+
+				date = eolutils.MoveToEndOfDay(d)
+			}
+		})
+		eolDates[version] = date
+	})
+
+	if len(eolDates) == 0 {
+		return nil, xerrors.Errorf("List of end-of-life dates is empty.")
+	}
+
+	// edge version doesn't have EOL. Add max date.
+	eolDates["edge"] = time.Date(9999, 1, 1, 0, 0, 0, 0, time.UTC)
+
+	return eolDates, nil
+}
+
+func (c Config) save(dates map[string]time.Time) error {
+	dir := filepath.Join(c.vulnListDir, eolAlpineFolder)
+
+	if err := utils.WriteJSON(c.appFs, dir, eolAlpineFile, dates); err != nil {
+		return xerrors.Errorf("failed to write %s under %s: %w", eolAlpineFile, eolAlpineFolder, err)
+	}
+	return nil
+}