Conversation
|
@coderabbitai full review |
✅ Actions performedFull review triggered. |
WalkthroughThis pull request adds support for syncing and analyzing OSV (Open Source Vulnerabilities) feeds for RHEL systems. The changes extend the existing OSV scanning infrastructure to handle RHEL-specific vulnerability data by introducing artifact download logic for RHEL OSV feeds, RPM package vulnerability matching, platform-specific processing, and a new vulnerability source enum. The cron scheduler is updated to orchestrate RHEL OSV checks alongside existing OVAL scanning with conditional cleanup of stale vulnerabilities based on configuration state. Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@cmd/fleet/cron.go`:
- Line 481: The call to cleanupStaleRHELOSVVulnerabilities is being executed
unconditionally, which can delete the old RHEL source even when the
replacement/sync/analyze step failed; change the flow so
cleanupStaleRHELOSVVulnerabilities(ctx, ds, logger,
config.OSVForVulnerabilities) only runs after the replacement pass completes
successfully — locate the code path that flips or performs the replacement of
osv_for_vulnerabilities and move or wrap the cleanup call inside the success
branch (check the success/err return of that replacement/sync/analyze function),
and apply the same gating to the other occurrences mentioned (the calls around
the later lines 636-637).
In `@server/vulnerabilities/osv/analyzer.go`:
- Around line 27-30: The IsPlatformSupported helper was broadened to include
"rhel" which causes Analyze to route RHEL artifacts into Ubuntu-specific logic
(extractUbuntuVersion, loadOSVArtifact) and produce errors instead of
ErrUnsupportedPlatform; revert or split this check so that IsPlatformSupported
only returns true for Ubuntu (or create a new generic helper like
IsLinuxPlatform and a distinct IsUbuntuPlatform used by Analyze). Update Analyze
to call the Ubuntu-specific gate (IsUbuntuPlatform) before invoking
extractUbuntuVersion/loadOSVArtifact, and ensure RHEL paths return
ErrUnsupportedPlatform or use their own analyzer when checkOSVVulnerabilities
iterates OS versions.
- Around line 452-458: The RHEL/RPM vulnerability handling omits the feed's fix
information; update the vuln append in the RPM path so that the
fleet.SoftwareVulnerability includes ResolvedInVersion set to vuln.Fixed
(similar to the Ubuntu path). Locate the loop over vulns where
isVulnerableRPM(sw.Version, sw.Release, vuln) is checked and add
ResolvedInVersion: vuln.Fixed to the constructed fleet.SoftwareVulnerability so
fixed RPM versions from the feed are preserved.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 36a40d83-19dd-4b54-a90c-1a450f6266d6
📒 Files selected for processing (7)
cmd/fleet/cron.goserver/fleet/vulnerabilities.goserver/vulnerabilities/osv/analyzer.goserver/vulnerabilities/osv/analyzer_test.goserver/vulnerabilities/osv/downloader.goserver/vulnerabilities/osv/sync.goserver/vulnerabilities/osv/sync_test.go
| analyzeSpan.End() | ||
|
|
||
| cleanupStaleOSVVulnerabilities(ctx, ds, logger, config.OSVForVulnerabilities) | ||
| cleanupStaleRHELOSVVulnerabilities(ctx, ds, logger, config.OSVForVulnerabilities) |
There was a problem hiding this comment.
Only purge the previous RHEL source after the replacement scan succeeds.
These deletes run even when the replacement path failed to sync or analyze. In that case, flipping osv_for_vulnerabilities can wipe the old RHEL source and leave hosts with no RHEL vuln coverage until a later successful run. Please gate the cleanup on a successful replacement pass instead of calling it unconditionally.
Also applies to: 636-637
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@cmd/fleet/cron.go` at line 481, The call to
cleanupStaleRHELOSVVulnerabilities is being executed unconditionally, which can
delete the old RHEL source even when the replacement/sync/analyze step failed;
change the flow so cleanupStaleRHELOSVVulnerabilities(ctx, ds, logger,
config.OSVForVulnerabilities) only runs after the replacement pass completes
successfully — locate the code path that flips or performs the replacement of
osv_for_vulnerabilities and move or wrap the cleanup call inside the success
branch (check the success/err return of that replacement/sync/analyze function),
and apply the same gating to the other occurrences mentioned (the calls around
the later lines 636-637).
| // IsPlatformSupported returns true if the given platform is supported by OSV. | ||
| func IsPlatformSupported(platform string) bool { | ||
| return strings.ToLower(platform) == "ubuntu" | ||
| p := strings.ToLower(platform) | ||
| return p == "ubuntu" || p == "rhel" |
There was a problem hiding this comment.
Don't route RHEL through the existing Ubuntu analyzer.
Broadening IsPlatformSupported here also changes the early gate in Analyze, but that code path still assumes Ubuntu artifacts (extractUbuntuVersion/loadOSVArtifact). Since checkOSVVulnerabilities() iterates every OS version, RHEL entries now fall into the Ubuntu analyzer and error instead of returning ErrUnsupportedPlatform. Please keep the Ubuntu analyzer gate explicit, or split the generic platform helper from the Ubuntu-specific one.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@server/vulnerabilities/osv/analyzer.go` around lines 27 - 30, The
IsPlatformSupported helper was broadened to include "rhel" which causes Analyze
to route RHEL artifacts into Ubuntu-specific logic (extractUbuntuVersion,
loadOSVArtifact) and produce errors instead of ErrUnsupportedPlatform; revert or
split this check so that IsPlatformSupported only returns true for Ubuntu (or
create a new generic helper like IsLinuxPlatform and a distinct IsUbuntuPlatform
used by Analyze). Update Analyze to call the Ubuntu-specific gate
(IsUbuntuPlatform) before invoking extractUbuntuVersion/loadOSVArtifact, and
ensure RHEL paths return ErrUnsupportedPlatform or use their own analyzer when
checkOSVVulnerabilities iterates OS versions.
| for _, vuln := range vulns { | ||
| if isVulnerableRPM(sw.Version, sw.Release, vuln) { | ||
| result = append(result, fleet.SoftwareVulnerability{ | ||
| SoftwareID: sw.ID, | ||
| CVE: vuln.CVE, | ||
| }) | ||
| } |
There was a problem hiding this comment.
Preserve the fixed RPM in ResolvedInVersion.
The Ubuntu OSV path already carries vuln.Fixed into ResolvedInVersion, but the RHEL path drops it. That loses remediation info for every RHEL vulnerability row even when the feed provides a fixed package version.
Proposed fix
for _, vuln := range vulns {
if isVulnerableRPM(sw.Version, sw.Release, vuln) {
+ var resolvedIn *string
+ if vuln.Fixed != "" {
+ fixed := vuln.Fixed
+ resolvedIn = &fixed
+ }
result = append(result, fleet.SoftwareVulnerability{
- SoftwareID: sw.ID,
- CVE: vuln.CVE,
+ SoftwareID: sw.ID,
+ CVE: vuln.CVE,
+ ResolvedInVersion: resolvedIn,
})
}
}🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@server/vulnerabilities/osv/analyzer.go` around lines 452 - 458, The RHEL/RPM
vulnerability handling omits the feed's fix information; update the vuln append
in the RPM path so that the fleet.SoftwareVulnerability includes
ResolvedInVersion set to vuln.Fixed (similar to the Ubuntu path). Locate the
loop over vulns where isVulnerableRPM(sw.Version, sw.Release, vuln) is checked
and add ResolvedInVersion: vuln.Fixed to the constructed
fleet.SoftwareVulnerability so fixed RPM versions from the feed are preserved.
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #43377 +/- ##
==========================================
- Coverage 66.85% 66.81% -0.04%
==========================================
Files 2588 2590 +2
Lines 207579 207921 +342
Branches 9175 9175
==========================================
+ Hits 138778 138929 +151
- Misses 56166 56345 +179
- Partials 12635 12647 +12
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
1 participant
Closes #43184
Changes
Adds RHEL OSV support to Fleet's vulnerability scanning pipeline, gated by the existing
osv_for_vulnerabilitiesconfig flag. When enabled, Fleet downloads RHEL OSV artifacts from GitHub releases, matches them against installed RPM software, and replaces both OVAL and goval-dictionary as the RHEL vulnerability source.What's new
Data model —
RHELOSVSource(value 9) added toVulnerabilitySourceenumSync (
server/vulnerabilities/osv/sync.go)RefreshRHEL()downloads RHEL OSV artifacts from GitHub releasesgetNeededRHELVersions()extracts major versions from RHEL hosts, skips FedoraremoveOldRHELOSVArtifacts()cleans up stale artifactsosv-ubuntu-*andosv-rhel-*assetsAnalyzer (
server/vulnerabilities/osv/analyzer.go)AnalyzeRHEL()scans RHEL hosts against OSV artifactsmatchSoftwareToRHELOSV()maps kernel variants (kernel-core, kernel-modules, etc.) tokernelisVulnerableRPM()compares RPM versions viautils.Rpmvercmp()(handles epochs)extractRHELMajorVersion()parsesOSVersion.Version(e.g.,"9.4.0"→"9")IsPlatformSupported()now returns true for bothubuntuandrhelCron (
cmd/fleet/cron.go)checkRHELOSVVulnerabilities()orchestrates refresh + analyzeplatform: "rhel",name: "Fedora...") stay in OVAL/goval — Red Hat OSV data does not cover FedoraGovalDictionarySourcenot bulk-deleted (shared with Amazon Linux) — relies on natural agingFedora handling
Fedora reports
platform: "rhel"in osquery. Red Hat OSV data does not include Fedora. Fedora hosts are explicitly skipped in:getNeededRHELVersions()— no artifact downloadedAnalyzeRHEL()— returnsErrUnsupportedPlatformTest plan
go test -v ./server/vulnerabilities/osv/...— all tests pass (existing + new)make lint-go— 0 issuesNew tests:
TestExtractRHELMajorVersion— version parsingTestIsVulnerableRPM— epoch handling, version/release comparison, introduced rangesTestMatchSoftwareToRHELOSV— kernel-* mapping, regular packages, patched packagesTestGetNeededRHELVersions— version extraction, Fedora skip, dedupTestRemoveOldRHELOSVArtifacts— cleanup isolation (RHEL vs Ubuntu artifacts)TestRHELOSVFilename— filename generationTestIsPlatformSupported— updated: RHEL now supportedManual verification:
Dependencies
--platform rhelsupport)Summary by CodeRabbit
New Features
Tests