| 15 | |
| 16 | |
| 17 | class XenImporter(Importer): |
| 18 | |
| 19 | url = "https://xenbits.xen.org/xsa/xsa.json" |
| 20 | spdx_license_expression = "LicenseRef-scancode-other-permissive" |
| 21 | notice = """ |
| 22 | From: George Dunlap <george.dunlap@cloud.com> |
| 23 | Date: Wed, Jan 25, 2023 at 4:57 PM |
| 24 | Subject: Re: Usage of Xen Security Data in VulnerableCode |
| 25 | To: Tushar Goel <tushar.goel.dav@gmail.com> |
| 26 | Cc: Andrew Cooper <Andrew.Cooper3@citrix.com>, xen-devel@lists.xenproject.org <xen-devel@lists.xenproject.org>, Xen Security <security@xen.org>, Philippe Ombredanne <pombredanne@nexb.com>, <jmhoran@nexb.com> |
| 27 | |
| 28 | On Thu, Jan 19, 2023 at 1:10 PM Tushar Goel <tushar.goel.dav@gmail.com> wrote: |
| 29 | > |
| 30 | > Hi Andrew, |
| 31 | > |
| 32 | > > Maybe we want to make it CC-BY-4 to require people to reference back to |
| 33 | > > the canonical upstream ? |
| 34 | > Thanks for your response, can we have a more declarative statement on |
| 35 | > the license from your end |
| 36 | > and also can you please provide your acknowledgement over the usage of |
| 37 | > Xen security data in vulnerablecode. |
| 38 | |
| 39 | |
| 40 | Hey Tushar, |
| 41 | Informally, the Xen Project Security Team is happy for you to include the data from xsa.json in your open-source vulnerability database. As a courtesy we'd request that it be documented where the information came from. (I think if the data includes links to then advisories on our website, that will suffice.) |
| 42 | Formally, we're not copyright lawyers; but we don't think there's anything copyright-able in the xsa.json: There is no editorial or creative control in the generation of that file; it's just a collection of facts which you could re-generate by scanning all the advisories. (In fact that's exactly how the file is created; i.e., the collection of advisory texts is our "source of truth".) |
| 43 | We do have "Officially license all advisory text as CC-BY-4" on our to-do list; if you'd be more comfortable with an official license for xsa.json as well, we can add that to the list. |
| 44 | |
| 45 | -George |
| 46 | """ |
| 47 | importer_name = "Xen Importer" |
| 48 | |
| 49 | def advisory_data(self): |
| 50 | data = fetch_response(self.url).json() |
| 51 | # The data looks like this |
| 52 | # [ |
| 53 | # { |
| 54 | # "xsas": [ |
| 55 | # { |
| 56 | # "cve": [ |
| 57 | # "CVE-2012-5510" |
| 58 | # ], |
| 59 | # "title": "XSA-1: Xen security advisory", |
| 60 | # } |
| 61 | # ] |
| 62 | # } |
| 63 | # ] |
| 64 | if not data: |
| 65 | return [] |
| 66 | xsas = data[0]["xsas"] |
| 67 | for xsa in xsas: |
| 68 | yield from self.to_advisories(xsa) |
| 69 | |
| 70 | def to_advisories(self, xsa): |
| 71 | xsa_id = xsa.get("xsa") |
| 72 | references = [] |
| 73 | url = self.url |
| 74 | if xsa_id: |
no outgoing calls