search

jeremylong / Open-Vulnerability-Project

Java libraries for working with available vulnerability data sources (GitHub Security Advisories, NVD, EPSS, CISA Known Exploited Vulnerabilities, etc.)
Apache License 2.0
112 stars 34 forks source link

feat: vulnz Docker v2 #114

Closed EugenMayer closed 9 months ago

EugenMayer commented 9 months ago

Based on all the work of https://github.com/jeremylong/Open-Vulnerability-Project/pull/87

Added

Discussions

Testing

I also based the helm chart on this image now

EugenMayer commented 9 months ago

@jeremylong let me know if you want anything to be changed. I got the CI integration running and testing in my fork and it works well for now. The PR workflow does not use any credentials and is safe, the release workflow, which will be triggered by you only, uses the usual github token authentication.

Anything else seems up and running, i got it running via the helm chart too. So from my POV, it is read for review or even merge.

EugenMayer commented 9 months ago

For everybody keen to test, i have published it temporary under https://github.com/users/eugenmayer/packages/container/package/vulnz so you can test-drive the docker image with

docker run -e NVD_API_KEY=yourkey ghcr.io/eugenmayer/vulnz:5.1.1

or use the helm chart at artifactory / source

EugenMayer commented 9 months ago

I would suggest, if there is such a bottleneck in doing reviews, that i fork the effort into a separate repository that builds released versions if this repository - so an entire standalone repository that the community can maintain, instead of you having the burden to maintain and work on it @jeremylong

I set myself a deadline in 2 weeks to iron out that repository, taking of the pressure from you here.

I hope this gets you well, this i do not want to torpedo this project, rather take weight from your shoulders maintain all "bits and pieces" - maybe you can then just focus on the actual library itself / cli tool.

jeremylong commented 9 months ago

Again - thank you for the PR. I've been exceedingly busy with other commitments. I'll try to get this published this week.

jeremylong commented 9 months ago

I think we should update the image name to open-vulnerability-data-mirror.

EugenMayer commented 9 months ago

@jeremylong you would need to expose the package in https://github.com/jeremylong?tab=packages so that it is actually public. AFAICS the workflow finished, but i cannot see the images, i assume they are yet private. Also be sure to link the package to the repository, if that has not been done via annotation already. Usually that is all done within a few seconds in the github UI.

I really value that you deploy to GHCR - personally, i do not even double-publich anylong on docker hub. When they introduced their rate limits and entire bonkers strategy, i entirely went away (years ago i started). I understand if you want to publish on both platforms, sure - but i consider GHCR to be the new better source - since no rate limits are applied.

Thank you for taking your time and pushing this one through!

jeremylong commented 9 months ago

The release workflow hasn't run yet as a new tag has not been published yet. I'm in the middle of a significant rework of the NVD API and should be done fairly soon - so I'll be pushing a new tag within a week.

EugenMayer commented 9 months ago

Sure, not worries.

EugenMayer commented 8 months ago

@jeremylong any progress on publishing the docker-images?

jeremylong commented 7 months ago

@EugenMayer the docker image should now be available. sorry about the delay. See https://github.com/jeremylong/Open-Vulnerability-Project/releases/tag/v5.1.2

EugenMayer commented 7 months ago

@jeremylong great, thank you

I have updated the helm chart https://github.com/EugenMayer/helm-charts/tree/main/charts/vulnz-nvd-mirror to use the new production image.

If you like or it make sense, we should make the people aware of the helm chart - but it is discover-able via https://artifacthub.io/packages/helm/eugen/vulnz-nvd-mirror