git: 2efbc338476e - main - security/periodic-filter-vuxml: New port

The branch main has been updated by grembo:

URL: https://cgit.FreeBSD.org/ports/commit/?id=2efbc338476e9bc3de2c8b7a072ca575440fa8f3

commit 2efbc338476e9bc3de2c8b7a072ca575440fa8f3
Author:     Michael Gmelin <[email protected]>
AuthorDate: 2026-08-18 12:56:40 +0000
Commit:     Michael Gmelin <[email protected]>
CommitDate: 2026-08-18 13:04:04 +0000

    security/periodic-filter-vuxml: New port
---
 security/Makefile                                  |   1 +
 security/periodic-filter-vuxml/Makefile            |  28 +++++
 .../files/400.filter-vuxml.in                      | 118 +++++++++++++++++++++
 security/periodic-filter-vuxml/pkg-descr           |   2 +
 security/periodic-filter-vuxml/pkg-message         |  25 +++++
 5 files changed, 174 insertions(+)

diff --git a/security/Makefile b/security/Makefile
index 8769b62f008a..74b008d83250 100644
--- a/security/Makefile
+++ b/security/Makefile
@@ -836,6 +836,7 @@
     SUBDIR += pecl-ssh2
     SUBDIR += pecl-xxtea
     SUBDIR += peda
+    SUBDIR += periodic-filter-vuxml
     SUBDIR += pev
     SUBDIR += pgpdump
     SUBDIR += pgpgpg
diff --git a/security/periodic-filter-vuxml/Makefile b/security/periodic-filter-vuxml/Makefile
new file mode 100644
index 000000000000..0517f9e5ead1
--- /dev/null
+++ b/security/periodic-filter-vuxml/Makefile
@@ -0,0 +1,28 @@
+PORTNAME=	periodic-filter-vuxml
+PORTVERSION=	1
+CATEGORIES=	security
+MASTER_SITES=	# none
+DISTFILES=	# none
+EXTRACT_ONLY=	# none
+
+MAINTAINER=	[email protected]
+COMMENT=	Periodic script to install a filtered version of VuXML
+
+LICENSE=	BSD3CLAUSE
+
+RUN_DEPENDS=	xml:textproc/xmlstarlet
+
+NO_ARCH=	yes
+NO_BUILD=	yes
+NO_INSTALL=	yes
+SUB_FILES=	400.filter-vuxml
+NO_WRKSUBDIR=	yes
+
+PLIST_FILES=	etc/periodic/security/400.filter-vuxml
+
+post-install:
+	${MKDIR} ${STAGEDIR}${PREFIX}/etc/periodic/security
+	${INSTALL_SCRIPT} ${WRKDIR}/400.filter-vuxml \
+		${STAGEDIR}${PREFIX}/etc/periodic/security
+
+.include <bsd.port.mk>
diff --git a/security/periodic-filter-vuxml/files/400.filter-vuxml.in b/security/periodic-filter-vuxml/files/400.filter-vuxml.in
new file mode 100644
index 000000000000..5e4dd2a39d1f
--- /dev/null
+++ b/security/periodic-filter-vuxml/files/400.filter-vuxml.in
@@ -0,0 +1,118 @@
+#!/bin/sh -f
+# shellcheck disable=SC3043,SC3037
+#
+# Copyright (c) 2026 Michael Gmelin. All rights reserved.
+#
+# Based on work done by:
+#
+# Copyright (c) 2004 Oliver Eikemeier. All rights reserved.
+# Copyright (c) 2014 Matthew Seaman <[email protected]>
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+# 1. Redistributions of source code must retain the above copyright notice
+#    this list of conditions and the following disclaimer.
+#
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# 3. Neither the name of the author nor the names of its contributors may be
+#    used to endorse or promote products derived from this software without
+#    specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
+# INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+# COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+# NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+
+if [ -r /etc/defaults/periodic.conf ]; then
+	. /etc/defaults/periodic.conf
+	source_periodic_confs
+fi
+
+: "${security_status_filter_vuxml_enable:=NO}"
+: "${security_status_filter_vuxml_period:=daily}"
+: "${security_status_filter_vuxml_expiry:=1}"
+: "${security_status_filter_vuxml_suppress_vids:=}"
+: "${security_status_filter_vuxml_suppress_cves:=}"
+
+# Compute PKG_DBDIR from the config file.
+pkgcmd=%%PREFIX%%/sbin/pkg
+PKG_DBDIR=$(${pkgcmd} config PKG_DBDIR)
+auditfile="${PKG_DBDIR}/vuln.xml"
+auditfile_prefilter="${PKG_DBDIR}/vuln_prefilter.xml"
+
+filter_vuxml() {
+	local modtime
+	local now
+	local rc
+
+	modtime=$(stat -f '%m' "$auditfile_prefilter" 2>/dev/null) || rc=3
+	now=$(date +%s) || return 3
+	# Add plenty of padding
+	if [ "$rc" != 0 ] ||
+		[ $(( 86400 * "${security_status_filter_vuxml_expiry}" )) \
+		  -le $(( now - modtime + 600 )) ]
+	then
+		# When non-interactive, sleep to reduce congestion on mirrors
+		anticongestion
+		${pkgcmd} audit -Fqd /var/empty -f "$auditfile_prefilter" \
+		  || return 3
+		modtime=$(stat -f '%m' "$auditfile_prefilter" 2>/dev/null) \
+		  || return 3
+	fi
+
+	echo -n 'Downloaded database created: '
+	date -r "${modtime}" -Iminutes || return 3
+
+	set --
+	echo 'Filtered vids: '
+	for vid in $security_status_filter_vuxml_suppress_vids; do
+		echo "- $vid"
+		set -- "$@" "-d" "_:vuxml/_:vuln[@vid='$vid']"
+	done
+
+	echo 'Filtered CVEs: '
+	for cve in $security_status_filter_vuxml_suppress_cves; do
+		echo "- $cve"
+		set -- "$@" "-d" \
+		  "_:vuxml/_:vuln/_:references/_:cvename[text()='$cve']"
+	done
+
+	if [ "$#" = 0 ]; then
+		echo "Nothing to filter"
+		cp "$auditfile_prefilter" "$auditfile" || return 3
+	else
+		%%PREFIX%%/bin/xml ed "$@" "$auditfile_prefilter" \
+		  >"$auditfile" || return 3
+	fi
+
+	return 0
+}
+
+rc=0
+
+if check_yesno_period security_status_filter_vuxml_enable
+then
+	echo
+	echo 'Installing filtered vulnerability database:'
+
+	if ! ${pkgcmd} -N >/dev/null 2>&1 ; then
+		echo 'pkg-audit is enabled but pkg is not used'
+		rc=2
+	else
+		filter_vuxml ; rc=$?
+	fi
+fi
+
+exit "$rc"
diff --git a/security/periodic-filter-vuxml/pkg-descr b/security/periodic-filter-vuxml/pkg-descr
new file mode 100644
index 000000000000..5571be5bc668
--- /dev/null
+++ b/security/periodic-filter-vuxml/pkg-descr
@@ -0,0 +1,2 @@
+FreeBSD periodic script to fetch and filter the VuXML database
+to allow silencing specific vids and CVEs.
diff --git a/security/periodic-filter-vuxml/pkg-message b/security/periodic-filter-vuxml/pkg-message
new file mode 100644
index 000000000000..87b985fbbc9f
--- /dev/null
+++ b/security/periodic-filter-vuxml/pkg-message
@@ -0,0 +1,25 @@
+[
+{ type: install
+  message: <<EOM
+Configuration is done in /etc/periodic.conf.
+
+Example:
+
+  sysrc -f /etc/periodic.conf security_status_filter_vuxml_enable=YES
+  sysrc -f /etc/periodic.conf security_status_filter_vuxml_suppress_vids+="
+    3a65fb7e-9ac2-11f1-bdc8-2cf05da270f3"
+  sysrc -f /etc/periodic.conf security_status_filter_vuxml_suppress_vids+="
+    05d311bc-9991-11f1-bc50-6cc21735f730"
+  sysrc -f /etc/periodic.conf security_status_filter_vuxml_suppress_cves+="
+    CVE-2026-5274"
+  sysrc -f /etc/periodic.conf security_status_filter_vuxml_suppress_cves+="
+    CVE-2026-5274"
+
+Note that suppressing CVEs is useful in case a VuXML entry contains
+multiple CVEs and only some should be ignored, otherwise the whole
+VuXML entry should be suppressed by vid.
+
+Use at you own risk.
+EOM
+}
+]