Add RHEL OSV vulnerability scanning#43377
Conversation
|
@coderabbitai full review |
✅ Actions performedFull review triggered. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✅ Files skipped from review due to trivial changes (1)
WalkthroughAdds RHEL support to the OSV pipeline: syncs RHEL OSV artifacts, loads and decodes gzip JSON RHEL feeds, extracts RHEL major versions, matches RPM packages (including kernel subpackages) against OSV introduced/fixed ranges, records RHEL-sourced vulnerabilities, introduces a new vulnerability source constant, and updates the cron/cleanup flow to conditionally remove stale RHEL OSV or OVAL records based on config flags. Platform filtering for OVAL/goval-dictionary was adjusted to keep Fedora-like RHEL entries. Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@cmd/fleet/cron.go`:
- Line 481: The call to cleanupStaleRHELOSVVulnerabilities is being executed
unconditionally, which can delete the old RHEL source even when the
replacement/sync/analyze step failed; change the flow so
cleanupStaleRHELOSVVulnerabilities(ctx, ds, logger,
config.OSVForVulnerabilities) only runs after the replacement pass completes
successfully — locate the code path that flips or performs the replacement of
osv_for_vulnerabilities and move or wrap the cleanup call inside the success
branch (check the success/err return of that replacement/sync/analyze function),
and apply the same gating to the other occurrences mentioned (the calls around
the later lines 636-637).
In `@server/vulnerabilities/osv/analyzer.go`:
- Around line 27-30: The IsPlatformSupported helper was broadened to include
"rhel" which causes Analyze to route RHEL artifacts into Ubuntu-specific logic
(extractUbuntuVersion, loadOSVArtifact) and produce errors instead of
ErrUnsupportedPlatform; revert or split this check so that IsPlatformSupported
only returns true for Ubuntu (or create a new generic helper like
IsLinuxPlatform and a distinct IsUbuntuPlatform used by Analyze). Update Analyze
to call the Ubuntu-specific gate (IsUbuntuPlatform) before invoking
extractUbuntuVersion/loadOSVArtifact, and ensure RHEL paths return
ErrUnsupportedPlatform or use their own analyzer when checkOSVVulnerabilities
iterates OS versions.
- Around line 452-458: The RHEL/RPM vulnerability handling omits the feed's fix
information; update the vuln append in the RPM path so that the
fleet.SoftwareVulnerability includes ResolvedInVersion set to vuln.Fixed
(similar to the Ubuntu path). Locate the loop over vulns where
isVulnerableRPM(sw.Version, sw.Release, vuln) is checked and add
ResolvedInVersion: vuln.Fixed to the constructed fleet.SoftwareVulnerability so
fixed RPM versions from the feed are preserved.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 36a40d83-19dd-4b54-a90c-1a450f6266d6
📒 Files selected for processing (7)
cmd/fleet/cron.goserver/fleet/vulnerabilities.goserver/vulnerabilities/osv/analyzer.goserver/vulnerabilities/osv/analyzer_test.goserver/vulnerabilities/osv/downloader.goserver/vulnerabilities/osv/sync.goserver/vulnerabilities/osv/sync_test.go
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #43377 +/- ##
==========================================
- Coverage 65.07% 65.05% -0.03%
==========================================
Files 2603 2604 +1
Lines 253139 254054 +915
Branches 9242 9242
==========================================
+ Hits 164740 165263 +523
- Misses 75638 75981 +343
- Partials 12761 12810 +49
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Pull request overview
Adds RHEL support to Fleet’s OSV-based vulnerability scanning pipeline (behind the existing osv_for_vulnerabilities flag), including artifact sync, analysis, and cron orchestration, with explicit Fedora exclusions.
Changes:
- Add RHEL OSV artifact download/cleanup + version discovery logic alongside existing Ubuntu OSV sync.
- Add RHEL OSV analyzer (RPM matching/version comparison) and expand OSV platform support detection.
- Wire RHEL OSV refresh/analyze into the vuln cron flow and introduce a new
RHELOSVSourcevulnerability source.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| server/vulnerabilities/osv/sync.go | Adds RHEL OSV artifact naming, refresh/sync, version extraction, and cleanup logic. |
| server/vulnerabilities/osv/downloader.go | Extends release asset selection to include osv-rhel-* and generalizes downloader helper via filename function. |
| server/vulnerabilities/osv/analyzer.go | Adds RHEL artifact model, RPM vulnerability matching, and RHEL OSV analysis flow. |
| cmd/fleet/cron.go | Orchestrates RHEL OSV refresh/analyze and excludes non-Fedora RHEL from OVAL + goval-dictionary when OSV is enabled. |
| server/fleet/vulnerabilities.go | Adds RHELOSVSource to VulnerabilitySource enum. |
| server/vulnerabilities/osv/sync_test.go | Adds tests for RHEL version selection, artifact cleanup isolation, and filename generation; updates downloader test call signature. |
| server/vulnerabilities/osv/analyzer_test.go | Adds tests for RHEL major version parsing, RPM version comparisons, and package-to-OSV matching. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.
Tip: disable this comment in your organization's Code Review settings.
Closes #43184
Changes
Adds RHEL OSV support to Fleet's vulnerability scanning pipeline, gated by the existing
osv_for_vulnerabilitiesconfig flag. When enabled, Fleet downloads RHEL OSV artifacts from GitHub releases, matches them against installed RPM software, and replaces both OVAL and goval-dictionary as the RHEL vulnerability source.What's new
Data model —
RHELOSVSource(value 9) added toVulnerabilitySourceenumSync (
server/vulnerabilities/osv/sync.go)RefreshRHEL()downloads RHEL OSV artifacts from GitHub releasesgetNeededRHELVersions()extracts major versions from RHEL hosts, skips FedoraremoveOldRHELOSVArtifacts()cleans up stale artifactsosv-ubuntu-*andosv-rhel-*assetsAnalyzer (
server/vulnerabilities/osv/analyzer.go)AnalyzeRHEL()scans RHEL hosts against OSV artifactsmatchSoftwareToRHELOSV()maps kernel variants (kernel-core, kernel-modules, etc.) tokernelisVulnerableRPM()compares RPM versions viautils.Rpmvercmp()(handles epochs)extractRHELMajorVersion()parsesOSVersion.Version(e.g.,"9.4.0"→"9")IsPlatformSupported()now returns true for bothubuntuandrhelCron (
cmd/fleet/cron.go)checkRHELOSVVulnerabilities()orchestrates refresh + analyzeplatform: "rhel",name: "Fedora...") stay in OVAL/goval — Red Hat OSV data does not cover FedoraGovalDictionarySourcenot bulk-deleted (shared with Amazon Linux) — relies on natural agingFedora handling
Fedora reports
platform: "rhel"in osquery. Red Hat OSV data does not include Fedora. Fedora hosts are explicitly skipped in:getNeededRHELVersions()— no artifact downloadedAnalyzeRHEL()— returnsErrUnsupportedPlatformTest plan
go test -v ./server/vulnerabilities/osv/...— all tests pass (existing + new)make lint-go— 0 issuesNew tests:
TestExtractRHELMajorVersion— version parsingTestIsVulnerableRPM— epoch handling, version/release comparison, introduced rangesTestMatchSoftwareToRHELOSV— kernel-* mapping, regular packages, patched packagesTestGetNeededRHELVersions— version extraction, Fedora skip, dedupTestRemoveOldRHELOSVArtifacts— cleanup isolation (RHEL vs Ubuntu artifacts)TestRHELOSVFilename— filename generationTestIsPlatformSupported— updated: RHEL now supportedManual verification:
Dependencies
--platform rhelsupport)Summary by CodeRabbit
New Features
Tests