ALTRepo ErrataServer

ALTRepo ErrataServer is a part of ALTRepo project that used to maintain data about ALT Linux distributions packages vulnerabilities status.

Project Summary and Purpose

ALTRepo ErrataServer tracks vulnerability status for ALT Linux packages and produces Errata records used across the ALTRepo pipeline. It builds Errata from task and branch history, stores change history, and keeps vulnerability mappings consistent over time. The service supports both automated generation (tasks, branches, refresh) and manual curation (SA Errata, CPE/PNC mappings). Operation is controlled through IP allowlists and access tokens, with dry_run and commit flags to preview or apply changes.

Used Terms

• Errata: a structured advisory record for a package update, including references to CVE/BDU/GHSA and related bugs.
• CVE: a globally recognized vulnerability identifier (Common Vulnerabilities and Exposures).
• CPE: a standardized product identifier (Common Platform Enumeration) used to align package data with vulnerability metadata.
• PNC: a package name conversion mapping that ties distro package names to upstream project identifiers or CPE sources.

API Overview

ErrataServer exposes a JSON API (see OpenAPI docs below) grouped around these operations:

• Service and docs: GET /, GET /version, GET /openapi.yaml, /docs
• Errata generation: POST /errata/branch, POST /errata/task/id, POST /errata/task/state
• Errata maintenance and IDs: POST /errata/refresh, POST /errata/fix/*, /errata_id/*
• History and reporting: /history/task, /history/branch, /history/package, /history/closed_cve, PUT /history/update
• Matching: /matcher/branch_update, /matcher/package, /matcher/cpe_*, /matcher/pnc_*, /matcher/cve_*
• Management: /manage/sa, /manage/errata, /manage/cpe, /manage/pnc

Examples (conceptual):

• GET /version returns service version and license info.
• POST /errata/task/id?id=123&dry_run=true generates Errata for a task.
• POST /matcher/branch_update?branch=p10&commit=true recalculates matches for a branch.

Business Logic Overview

Errata generation combines changelog references with version-based CVE matching to produce ErrataHistory and ErrataChange records. Bulletin Errata summarize branch-level updates for a date, while task and branch Errata focus on package changes. Errata IDs provide stable identifiers and version increments when records are updated or discarded. Management endpoints record user context and reasons, and return affected package-CVE matches to show impact. The refresh workflow collects candidate updates in dry_run mode and commits them with a transaction ID when approved.

Matching Algorithm Overview

The matcher collects package-to-CPE matches and CVE-to-CPE matches from the database, normalizes them into CPE triplets, and only compares compatible pairs. For each candidate pair, it compares package versions against CVE affected ranges (including open-ended ranges) to determine vulnerability status. SA patch rules can exclude or override matches for specific CVEs, CPEs, or packages. Matches are hashed to avoid duplicates; only new or patched matches are stored when commit=true.

Example flow: add a CPE mapping via /manage/cpe/create, then call /matcher/cpe_add to recalculate affected CVEs.

License

GNU AGPLv3

Dependencies

System packages

ALT release metadata is taken from the alt-releases-matrix package, which ships the alt_releases_matrix crate at /usr/share/alt-releases-matrix/lib/rust. The crate is referenced by path, so the package must be installed before the build.

Install the build dependencies:

apt-get install rust alt-releases-matrix

Note: rust pulls in rustc and rust-cargo.

Rust crates

All Rust crates dependencies are included in Cargo.toml file and resolved from crates.io, except alt_releases_matrix, which is provided by the system package above:

alt_releases_matrix = { path = "/usr/share/alt-releases-matrix/lib/rust", version = ">=0.3.2" }

Note: the minimal version bound is intentional. The build fails when the installed alt-releases-matrix package is older than required, which prevents building against a stale branch matrix. Update the package instead of relaxing the bound.

Running application

Project includes necessary files to run application in a Docker container using docker compose with followign steps:

Prepare configuration files

Copy and edit configuration file:

cp config.toml.example config.toml

nano config.toml

Note: Apllication supports client' IP whitelists including networks and single addresses.

Copy and edit env file:

cp .env.example .env

nano .env

Note: Application logging level could be set to: debug, info or error through APP_LOG_LEVEL variable.

Start an application container

Start an application container using docker compose:

docker compose up -d

API documentation

ErrataServer API documentation is avalable through OpenAPI YAML file and Redoc interface

OpenAPI 3.1 spec: [GET] errata.server/openapi.yaml

Redoc: http://erraa.server/docs