Gitiles
Code Review Sign In
gerrit.avm99963.com / gomodules / vulnzybot / 7f6592a3648487fe61f4d88c0964281f3ba6ab55
commit7f6592a3648487fe61f4d88c0964281f3ba6ab55[log] [tgz]
authorAdrià Vilanova Martínez <me@avm99963.com>Tue Jul 19 20:06:25 2022 +0200
committerAdrià Vilanova Martínez <me@avm99963.com>Tue Jul 19 20:06:25 2022 +0200
treeb33a28ec88fca0a413e806551a0aaf2e4a14513c
parente73997b63846e3905f59351f0c36a491ebcf86ca [diff]
Fix issue with missing package in go.sum

In another machine, this error appeared:

```
go: go.skia.org/infra@v0.0.0-20220714212951-8117921d36db requires
	cloud.google.com/go/bigtable@v1.6.0: missing go.sum entry; to add it:
	go mod download cloud.google.com/go/bigtable
```

Change-Id: Ie4fbcf83ad6eaff9fcdc033b8d1429b90fd81e1b
1 file changed
tree: b33a28ec88fca0a413e806551a0aaf2e4a14513c
  1. .env
  2. .gitignore
  3. .gitreview
  4. crontab
  5. dateUtils.go
  6. docker-compose.yml
  7. Dockerfile
  8. go.mod
  9. go.sum
  10. Makefile
  11. README.md
  12. vulnzybot.go
README.md

Vulnzy Bot

A bot which is responsible for managing the vulnerability reports published at https://iavm.xyz/b/vulnz.

Tasks

The bot performs the following tasks:

Automatically publish vulnerability reports after the deadline

The bot will search private (restricted) vulnerability reports and will do the following:

  • If the report has the "DoNotPublish" label, don't automatically publish it.
  • If the report was marked with status "Fixed" or "Verified" more than 30 days ago, publish it.
  • If the report isn't marked as "Fixed"/"Verified" and the "Reported" value is previous to the current time subtracting the number of days set in the "Deadline" field, publish it.

In all the calculations above, a grace period of 1 day is added (so in reality it's 31 days instead of 30, and Deadline + 1 day instead of Deadline).

Add a disclosure alert 5 days before it is automatically disclosed

The bot will add a comment to a vulnerability report 5 days before it is automatically disclosed as explained in the previous section.

Set up

  1. Set up Git Watcher:
    • Create a service account in your Google Cloud project.
    • Give it permission to use the Monorail API.
    • Give it appropiate permissions in each Monorail project.
    • Create subdirectory //secret/ and download the service accounts credentials JSON file to //secret/credentials.json.
    • Run make docker-prod and docker-compose up -d.