fleet/server/vulnerabilities/msrc
Ian Littman e8a6456f13
Don't reuse GitHub HTTP client to pull MSRC feeds (#22493)
See #22492

As of today, MSRC's API will 401 if you pass it a JWT it doesn't expect,
and by reusing the GitHub API HTTP client for MSRC pulls we were passing
the API an unexpected JWT. Wasn't able to reproduce this locally because
I didn't need a GitHub token locally to pull release details, while the
token is populated in Actions. Was able to repro both the issue and this
fix inside Actions on my fork.

This also updates to call v3.0 of the API directly, which v2.0 has been
redirecting to for awhile.

Finally, adds slightly better logging so we know which part of the feed
generation process we're in when we're running this in Actions.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Manual QA for all new/changed functionality
2024-09-27 21:23:48 -05:00
..
parsed Update Windows OS Version Reporting (#17682) 2024-05-01 12:02:16 -06:00
testdata Add resolved_in_version for Windows OS Vulns (#16546) 2024-02-07 06:19:59 -07:00
xml Feature 7077: Add MSRC feed parser (#7424) 2022-08-30 16:39:50 -04:00
analyzer.go Add resolved_in_version for Windows OS Vulns (#16546) 2024-02-07 06:19:59 -07:00
analyzer_test.go Add resolved_in_version for Windows OS Vulns (#16546) 2024-02-07 06:19:59 -07:00
msrc_api.go Don't reuse GitHub HTTP client to pull MSRC feeds (#22493) 2024-09-27 21:23:48 -05:00
msrc_api_test.go Feature 9386: Parse the Mac Office release notes for vulnerability processing (#9993) 2023-02-24 14:18:25 -04:00
parser.go Switching from FixedBuild to FixedBuilds (part 1). (#16454) 2024-01-30 10:43:28 -06:00
parser_test.go Switching from FixedBuild to FixedBuilds (part 2). (#16465) 2024-01-30 14:24:41 -06:00
sync.go Feature 9386: Parse the Mac Office release notes for vulnerability processing (#9993) 2023-02-24 14:18:25 -04:00
sync_test.go Improve test coverage and bug fix (#10301) 2023-03-06 15:07:27 -04:00