gocsaf / csaf

Tools to download or provide CSAF (Common Security Advisory Framework) documents.
https://csaf.io
42 stars 25 forks source link

Checker: ROLIE validation too late? #408

Open tschmidtb51 opened 1 year ago

tschmidtb51 commented 1 year ago

Today, I run into a situation, while I tried to validate a new CSAF trusted provider: The csaf_checker reported:

"Loading ROLIE feed failed: https://support.citrix.com/.well-known/csaf/public/feed-tlp-white.json: json: cannot unmarshal object into Go struct field FeedData.feed.link of type []csaf.Link."

At first, I was confused why I get a Go error message but during the debug, I realized that we do the validation after this error occurs. So my question is: Should we validate the JSON schema first before we try to put it into our structure or is that behavior expected?