CSAF Modifier Tool

CSAF modifier according to the CSAF 2.0 specification: https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html#918-conformance-clause-8-csaf-modifier

• Takes a CSAF document as input (file or stdin)
• accoding to user configuration it applies:
  • change the publisher
  • add notes
  • replace the legal disclaimer
  • add new references
• It always
  • changes the document tracking ID publisher replaced, 2 notes added, legal disclaimer set, 1 reference added
  • increments the major version
  • sets the status to final if the old version required a draft status
  • adds a reference to the original CSAF document as the first reference
  • converts the original self-reference into an external one
  • adds a new self-reference for the modified document
  • adds a revision history entry describing the applied changes, for example:
• Validates the conformity of the resulting modified CSAF document
• Writes the result to the output file or stdout

$ csaf-modifier example.json --legal-disclaimer "This is the new disclaimer" | jq .document.notes[2]
{
  "category": "legal_disclaimer",
  "text": "This is the new disclaimer"
}

$ csaf-modifier example.json --publisher-name 'New publisher' --publisher-category discoverer --publisher-contact-details discoverer@example.com --publisher-namespace https://example.com/ | jq .document.publisher
{
  "category": "discoverer",
  "contact_details": "discoverer@example.com",
  "name": "New publisher",
  "namespace": "https://example.com/"
}

Both the input and the output CSAF document can be either files or stdin/stdout.

The status handling needs no configuration.

The CSAF specification requires the status draft for version specifications with with major version 0 and pre-release versions (CSAF 2.0 specification sections 3.1.11.1 and 3.1.11.2). With the automatic increament of the major version, a document may loose the requirement for the draft state. Then the status is set to final.

The reference handling needs no configuration.

For example, when the input document has the self-reference https://example.com/csaf/orig.json, then the resulting document has the following reference changes:

The new self-reference URL is derived from the original self-reference's path.

If the input document has no self-reference, the CSAF modifier logs a warning and leaves /document/references[] unchanged.

If the publisher is to be set, category, name and namespace are required. Contact details and issuing authority are optional.

Repeatable: each occurrence of --note-text starts a new note. If --note-category/--note-title/--note-audience are used, they must be given exactly as many times as --note-text, and are paired up by position.

Repeatable: each occurrence of --reference-url starts a new reference and requires a matching --reference-summary at the same position.

 SPDX-License-Identifier: Apache-2.0

 SPDX-FileCopyrightText: 2024 German Federal Office for Information Security (BSI) <https://www.bsi.bund.de>
 Software-Engineering: 2024 Intevation GmbH <https://intevation.de>