0.0.0-alpha.8

Changelog

Unreleased (2024-08-07)

⚠ BREAKING-CHANGE

• Breaks the migrations as this PR rewrites the historyto use UUID instead of i32 from the start.

Features

• allow using a dedicated working dir for dumps (9cc1302)
• Add maven version comparison SQL function. (7efd883)
• add an xtask for generating a pre-loaded DB dump (59889af)
• S3 storage backend (978a2be), closes guacsec#621
• add PurlService method that can gc dead purls. (11b0ede)
• Add api to delete Vulnerabilities. (ad0f2fb), closes guacsec#563
• Add api to delete Advisories. (220863f), closes guacsec#563
• add the ability to specify a branch for importing OSV (c31462c)
• Add api to delete products (807dcb5), closes guacsec#563
• Add api to delete sboms (2e6b810), closes guacsec#563
• add rapidoc support (c5df2c5)
• add trustd subcommand to export openapi spec (0ffc786)
• new convention for organizing integration tests (f653c02)
• add import warnings to the report (b59a19b)
• use v5 uuid upsert for CPEs (1fd7470)
• add cpe creator (7c5ee80)
• ingest products from sboms (d5ec88c)
• add more data to the products API (0983ac3)
• allow canceling import runs (7c53e9e)
• add sha384 and sha512 to the SBOM and advisory (bf67cdc)
• add GIN index for labels (3319040)
• add more labels to imported documents, allow user defined labels (87b6a6e)
• return description as well (63a0edd)
• allow setting labels during upload (34d2c06)
• return labels when fetching sboms or advisories (dd54b9f)
• implement setting labels for SBOMs (cf59c85)
• implement setting labels for advisories (22741d5)
• enable backslash to escape operators in filter expressions (5e66c77), closes
  guacsec#434
• extract organization name from CVE (1065ab3)
• add CWE for vulnerabilities (181719d)
• implements labels using jsonb (d6b4302)

Fixes

• delete operations were missing from api docs. (bdd3b38)
• generate config schema and ensure they are up-to-date (6ff7e9b)
• use load_one pattern to load all organizations for mulitple products
  (537c640)
• use load_many pattern to efficiently load versions for multiple products
  (020ad82)
• make storage CLI options mutually exclusive (e03fda1), closes guacsec#631
• remove usage of FileSource and document how to use csaf walker to ingest
  local files (398ebf5)
• sbom_node FK constraints (37d396f)
• issue with duplicate packages (399645a)
• only force devmode if the embedded OIDC is requested (4bc17f3)
• add the deleteSbom api operationId. (ca3a047)
• define the schema type of the if-match headers. (c198f04), closes guacsec#580
• Add openapi operation ids (738d10b), closes guacsec#580
• increase recursion limit (3130c74)
• strum build error (4608dff)
• remove "ui" feature (7f12f71), closes guacsec#559
• remove non-normative data from advisory vulnerability (1a2714a), closes
  guacsec#543
• auto-create vulnerabilities using upsert (e516b42)
• swagger-ui for product details (b42ed10), closes guacsec#545
• swagger-ui docs for organization (c787eb3), closes guacsec#544
• ensure that descriptions are not growing with every insert (f7c4f06)
• also check for vuln-id to create all entries (0dc4583)
• apply the CPE fix also for the language (dc7c328)
• prevent the creation of duplicate CPEs (130e41f)
• use the "last_success" time for the next "since" (2456d9e)
• only add the package manager category as a name for that package (1b39eaa)
• used for both advisories and SBOMs (1d536b7)
• retrying later on change means, accepting it now (e3e9c15)
• catch cases of invalid SPDX references and report them as such (094ef8b)
• bump pg-embed to avoid github rate-limiting during tests (7e62347)
• clean up a few openapi issues around labels (94a47eb)
• this file actually belongs to migration 230 (29a52a0)
• the q param now works for /api/v1/sbom/{key}/packages (f36b558), closes
  guacsec#434
• allow ingesting spdx SBOMs with files (1f2145e)
• relationship direction for "documentDescribes" (058ee24)
• link with specific node, not any node of the SBOM (8d87482)

v0.1.0-alpha.8 (2024-06-24)

Features

• initial product endpoints (6112344)
• add filtering/query to "find by sbom package" (93e3eaa), closes guacsec#438
• search SBOMs by PURL or package id (a4ce8ec), closes guacsec#413
• add version to sbom package (20eefb2), closes guacsec#284
• support IS [NOT] NULL in queries (5b658cb)
• add ability to translate queries (8c6f062)
• more efficient detection of advisory formats (d669658), closes guacsec#257
• Initial implementation of products (2573b01)
• add an entry for all CSAF data (bc9e6a5)
• update cyclonedx for support of 1.5 (9817ffa)
• allow configuring the OIDC UI settings (f2ad362)
• implement CVE import (f6d2cde)
• implement OSV ingestion (0bc8a20)
• add cyclonedx support (0570cfb)
• provide some default/sample data for PM mode (0d0d5a4)
• support CVE ingestion (7df5273)
• detect advisory format and location (e73a7ef), closes guacsec#144
• make LIKE queries case-insensitive by using Postgres' ILIKE (5e2e357)
• add authors field, and align id field name (857a8aa)
• fetch: allow fetching sbom packages (ec4ab6a)
• allow fetching sbom summaries and "describes" packages (ea5eab4)
• use creator for optimized imports (3014f17)
• ingestor: default to sha384 hashing and allow for algorithm
  customization (0dcbc19), closes guacsec#161
• improve performance once more using a relationship cache (5a69fd6)
• allow searching for SBOMs (8f4a3ac)
• accept human date filters (7c0f54b), closes #145
• add a NotLike operator, !~ (32e02b3), closes guacsec#148
• support OR clause values, e.g. a|b|c (bd4a4c7)
• support queries containing '&' if escaped, e.g. "M&M's" (1db672b)
• support AND/OR operators and full-text search (a2e0cdf)
• add search (507c670)
• allow preventing a reset of the database (435c5bb)
• implement SBOM upload and download over the API (47919b0)
• add a basic index document (3db1857)
• add some filesystem storage (d8ae8c6)
• add composite openapi specification and swagger ui (9f0bba4)
• implement csaf importer for server (8fcf779)
• revamp pagination according to our discussion (f42b518)
• add server for processing imports (8b3a59e)
• add optimistic locking for importer config (3910159)
• implement API for importer, based on mock backend (2f162a6)
• add authentication (0e9ff11)
• import: allow using multiple worker (beef601)
• import: add a progress meter for getting an ETA (194ed54)
• allow filtering from the command line (8f9178d)
• add sbom importer (ce533af)
• refactor importer command and create a base for adding sbom importer
  (90f1e55)
• calculate digest if not present (d5f7122)
• add configurable source for the importer (9db0e37)
• allow bootstrapping the database (8c6a2c9)
• add basic HTTP server and make configurable db connection info (84d29eb)
• add basic cli (e2deeb2)
• ingest "fixed" state for vulnerabilities (1134ea0)

Fixes

• appease graphql and openapi paths wrt slashes (07629a9), closes guacsec#376 guacsec#422
• honor transaction for requests (97510e7)
• return only the sbom_node, not all nodes belonging to the sbom (6349e91),
  closes guacsec#414
• provide the package describing the sbom with the summary (ea8af78)
• enable sorting advisories by average_severity (8de5be2), closes guacsec#383
• move graphql under /graphql only (f07f5fa)
• count items being processed for osv and cve (a1f8d21)
• Restore /api/v1/sbom/{key} SBOM metadata access (7bb7c69), closes guacsec#253
• the the id issue for SBOMs too (a52b6f4)
• translate the id into a hash before fetching from the storage (12c0d71)
• use newer container to fix/workaround segfault in libgit2 (16deb09)
• accept either domain or full URL (d601573)
• register types, remove infinite reference (724a788)
• reset all jobs when starting up (88ec8da), closes guacsec#355
• use correct env-vars for storage settings (a93be47)
• update cve to fix some parsing errors (d46683a)
• directly pass sha256 digest, parsing it misses the perfix (feba99a)
• client ids need to split by comma when coming from the env-var (08c1402)
• update embedded oidc to support refresh tokens (f01dcc5)
• push multi-arch image (d90dae0)
• allow swaggerui to redirect (1bb1ca1)
• ingest scores when loading CSAF docs (4719406), closes guacsec#278
• have a default limit of 25 (44d4a01), closes guacsec#287
• ensure order using primary keys, not hardcoded id fields (9f5f01f), closes
  guacsec#267
• swagger-ui by pulling in utoipa upstream fix (ed0efb1), closes guacsec#235
• using default password for PM mode (67e94c3)
• fixing openapi (ddb2694)
• handle empty search options when filtering (4a662cf), closes guacsec#219
• flatten calls during ingestion (56cbbb9)
• that index should be unique (638f467)
• if auth is disabled, don't use it for swagger ui (1929f8b)
• logging in PM mode is more sane now (eb87749), closes guacsec#135
• bump db creation timeout from the 10s default to 30s (b33699c)
• wrap trustd behavior in Infrastructure block (46d8dea), closes guacsec#135
• set the data_dir field to retain data across restarts (0bff480), closes
  guacsec#171
• ingestor: update use of HashingRead::finish (fa6617b)
• ingestor: update HashingRead::finish to return result (8d80b73)
• require qualifiers to match as well (311f199)
• improve performance by using indexes for the important queries (4b2e78a)
• properly define primary key (f24287f)
• use caches to prevent repeated lookups (3f0719b)
• do not repeat ingesting the packages (c6547d1)
• don't treat all possible query values as strings (27ff514), closes guacsec#156
• swagger endpoint path for advisory search (026916e)
• handle missing sort parameter (6464282)
• don't use limit for offset (3653677)
• ingest csaf documents in a single transaction (ad9196a)
• add test for optimistic locking and fix it (3515611)
• don't rely on PWD for test data (7cdbf0e)
• handle bad PURLs (3358a93)
• initialize logging (2ed2ca8)
• add missing column (c17e3c5)
• use explicit env-var names (a02a909)
• update after api change (4d73efc)