Skip to content

Conversation

@VanitasCodes
Copy link

Description

This PR adds AlmaLinux errata support to help reduce false positives when scanning AlmaLinux systems.

AlmaLinux backports security fixes without changing version numbers, which causes cve-bin-tool to report already-patched CVEs. This data source fetches errata from AlmaLinux and provides information about which CVEs have been fixed.

What's Included

  • New data source: alma_source.py that fetches from errata.almalinux.org
  • Comprehensive tests with 100% code coverage
  • Support for both AlmaLinux 8 and AlmaLinux 9
  • Fallback to urllib when aiohttp has DNS issues on Windows

Testing

  • Fetches ~4,000 advisories containing 11,000+ CVE entries
  • Processes 169,000+ affected packages
  • All 7 unit tests pass
  • All pre-commit hooks pass (interrogate, black, flake8, bandit, etc.)

Related Issues

@VanitasCodes
Copy link
Author

Hi @terriko!

I've implemented the AlmaLinux errata support we discussed in #5464. This PR adds a native data source that:

  • Fetches errata from both AlmaLinux 8 and 9
  • Processes 4,000+ advisories with 11,000+ CVE entries
  • Should significantly reduce false positives for AlmaLinux users

The implementation follows the same pattern as the existing RedHat data source. All tests are passing locally with 100% code coverage.

Let me know if you'd like any changes or have questions about the implementation!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

feat: Add AlmaLinux errata support to reduce false positives

1 participant