[SKIP] Seed the `vulnerability_advisories` table with gemnasium advisories
Why are we doing this work
For &7886, we will be storing vulnerability advisories in Postgres and comparing them with SBoM components in order to determine if a component is affected by a vulnerability. We need a way to seed this table with advisories, and also keep it in sync with advisory-database as new advisories are added by groupvulnerability research.
Relevant links
Non-functional requirements
-
Documentation: -
Feature flag: -
Performance: -
Testing:
Implementation plan
-
backend Create a new table vulnerability_advisory_configurationwith fieldsadvisory_db_urlandadvisory_db_git_ref.advisory_db_urlwill store the git repo URL of the advisory database (For GitLab.com it will behttps://gitlab.com/gitlab-org/security-products/gemnasium-db) -
backend Create a new service ( Security::AdvisoryDatabase::SyncService) that reads the repository configured inadvisory_db_urland walks through each of the advisories and persists them tovulnerability_advisories. Ifadvisory_db_git_refis passed to the service (as argument), it should sync the advisories that are created/updated from that reference. -
backend Create a rake task that calls the service ( Security::AdvisoryDatabase::SyncService)
Edited by Sashi Kumar Kumaresan