master
b97fc7685a
Some checks failed
Build Test Deploy / authority-container (push) Has been cancelled
Build Test Deploy / docs (push) Has been cancelled
Build Test Deploy / deploy (push) Has been cancelled
Build Test Deploy / build-test (push) Has been cancelled
Docs CI / lint-and-preview (push) Has been cancelled
29 lines
2.0 KiB
Markdown
29 lines
2.0 KiB
Markdown
# AGENTS
|
|
## Role
|
|
VMware/Broadcom PSIRT connector ingesting VMSA advisories; authoritative for VMware products; maps affected versions/builds and emits psirt_flags.
|
|
## Scope
|
|
- Discover/fetch VMSA index and detail pages via Broadcom portal; window by advisory ID/date; follow updates/revisions.
|
|
- Validate HTML or JSON; extract CVEs, affected product versions/builds, workarounds, fixed versions; normalize product naming.
|
|
- Persist raw docs with sha256; manage source_state; idempotent mapping.
|
|
## Participants
|
|
- Source.Common (HTTP, cookies/session handling if needed, validators).
|
|
- Storage.Mongo (document, dto, advisory, alias, affected, reference, psirt_flags, source_state).
|
|
- Models (canonical).
|
|
- Core/WebService (jobs: source:vmware:fetch|parse|map).
|
|
- Merge engine (later) to prefer PSIRT ranges for VMware products.
|
|
## Interfaces & contracts
|
|
- Aliases: VMSA-YYYY-NNNN plus CVEs.
|
|
- Affected entries include Vendor=VMware, Product plus component; Versions carry fixed/fixedBy; tags may include build numbers or ESXi/VC levels.
|
|
- References: advisory URL, KBs, workaround pages; typed; deduped.
|
|
- Provenance: method=parser; value=VMSA id.
|
|
## In/Out of scope
|
|
In: PSIRT precedence mapping, affected/fixedBy extraction, advisory references.
|
|
Out: customer portal authentication flows beyond public advisories; downloading patches.
|
|
## Observability & security expectations
|
|
- Metrics: SourceDiagnostics emits shared `feedser.source.http.*` counters/histograms tagged `feedser.source=vmware`, allowing dashboards to measure fetch volume, parse failures, and map affected counts without bespoke metric names.
|
|
- Logs: vmsa ids, product counts, extraction timings; handle portal rate limits politely.
|
|
## Tests
|
|
- Author and review coverage in `../StellaOps.Feedser.Source.Vndr.Vmware.Tests`.
|
|
- Shared fixtures (e.g., `MongoIntegrationFixture`, `ConnectorTestHarness`) live in `../StellaOps.Feedser.Testing`.
|
|
- Keep fixtures deterministic; match new cases to real-world advisories or regression scenarios.
|