Skip to content

[SKIP] Seed the `vulnerability_advisories` table with gemnasium advisories

Why are we doing this work

For &7886, we will be storing vulnerability advisories in Postgres and comparing them with SBoM components in order to determine if a component is affected by a vulnerability. We need a way to seed this table with advisories, and also keep it in sync with advisory-database as new advisories are added by groupvulnerability research.

Relevant links

Non-functional requirements

  • Documentation:
  • Feature flag:
  • Performance:
  • Testing:

Implementation plan

  • backend Create a new table vulnerability_advisory_configuration with fields advisory_db_url and advisory_db_git_ref. advisory_db_url will store the git repo URL of the advisory database (For GitLab.com it will be https://gitlab.com/gitlab-org/security-products/gemnasium-db)
  • backend Create a new service (Security::AdvisoryDatabase::SyncService) that reads the repository configured in advisory_db_url and walks through each of the advisories and persists them to vulnerability_advisories. If advisory_db_git_ref is passed to the service (as argument), it should sync the advisories that are created/updated from that reference.
  • backend Create a rake task that calls the service (Security::AdvisoryDatabase::SyncService)
Edited by Sashi Kumar Kumaresan