stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 1 Releases Wiki Activity
Files
ea1106ce7ccaca83151cd018bad43a9a9d3b7cc6
git.stella-ops.org/src/StellaOps.Feedser.Source.Vndr.Vmware/AGENTS.md
master b97fc7685a
Some checks failed
Build Test Deploy / authority-container (push) Has been cancelled
Details
Build Test Deploy / docs (push) Has been cancelled
Details
Build Test Deploy / deploy (push) Has been cancelled
Details
Build Test Deploy / build-test (push) Has been cancelled
Details
Docs CI / lint-and-preview (push) Has been cancelled
Details
Initial commit (history squashed)
2025-10-11 23:28:35 +03:00

2.0 KiB
Raw Blame History

AGENTS

Role

VMware/Broadcom PSIRT connector ingesting VMSA advisories; authoritative for VMware products; maps affected versions/builds and emits psirt_flags.

Scope

  • Discover/fetch VMSA index and detail pages via Broadcom portal; window by advisory ID/date; follow updates/revisions.
  • Validate HTML or JSON; extract CVEs, affected product versions/builds, workarounds, fixed versions; normalize product naming.
  • Persist raw docs with sha256; manage source_state; idempotent mapping.

Participants

  • Source.Common (HTTP, cookies/session handling if needed, validators).
  • Storage.Mongo (document, dto, advisory, alias, affected, reference, psirt_flags, source_state).
  • Models (canonical).
  • Core/WebService (jobs: source:vmware:fetch|parse|map).
  • Merge engine (later) to prefer PSIRT ranges for VMware products.

Interfaces & contracts

  • Aliases: VMSA-YYYY-NNNN plus CVEs.
  • Affected entries include Vendor=VMware, Product plus component; Versions carry fixed/fixedBy; tags may include build numbers or ESXi/VC levels.
  • References: advisory URL, KBs, workaround pages; typed; deduped.
  • Provenance: method=parser; value=VMSA id.

In/Out of scope

In: PSIRT precedence mapping, affected/fixedBy extraction, advisory references. Out: customer portal authentication flows beyond public advisories; downloading patches.

Observability & security expectations

  • Metrics: SourceDiagnostics emits shared feedser.source.http.* counters/histograms tagged feedser.source=vmware, allowing dashboards to measure fetch volume, parse failures, and map affected counts without bespoke metric names.
  • Logs: vmsa ids, product counts, extraction timings; handle portal rate limits politely.

Tests

  • Author and review coverage in ../StellaOps.Feedser.Source.Vndr.Vmware.Tests.
  • Shared fixtures (e.g., MongoIntegrationFixture, ConnectorTestHarness) live in ../StellaOps.Feedser.Testing.
  • Keep fixtures deterministic; match new cases to real-world advisories or regression scenarios.