Gentoo Bugzilla Security RSS Processor — Design
Overview
Fetches security vulnerability reports from the Gentoo Bugzilla Atom feed and
creates first-class CVEMetadata rows (source=gentoo) with minted
GENTOO-YYYY-{bugID} identifiers where {bugID} is the Gentoo Bugzilla
bug number.
Only bugs with Product: Gentoo Security and Component: Vulnerabilities are
processed — all other Bugzilla entries (build failures, feature requests, etc.)
are skipped.
CVE IDs found in bug titles are extracted and stored as GcveAlias and
CVEAlias records linking them to the minted GENTOO identifier.
Feeds
| Property | Daily Feed | Backfill Feed |
|---|---|---|
| URL | https://bugs.gentoo.org/buglist.cgi?chfield=%5BBug%20creation%5D&chfieldfrom=1d&ctype=atom | https://bugs.gentoo.org/buglist.cgi?chfieldfrom=9999d&ctype=atom |
| Auth | None — fully public | None — fully public |
| Format | Atom 1.0 | Atom 1.0 |
| Scope | Bugs created in last 24 hours | All bugs ever created |
| Use | ECS daily scheduled task | Local backfill via --backfill flag |
Parsing
| Field | Source |
|---|---|
| Bug ID | Extracted from <link> URL parameter id=NNNNNN |
| Bug URL | <link> href attribute (fallback: <id>) |
| Title | <title> — e.g., [Bug 971278] dev-python/pyasn1-0.6.3: stack overflow |
| Package Atom | Regex on title: category/package (e.g., dev-python/pyasn1) |
| Package Version | Regex on title: version after package name (e.g., 0.6.3) |
| Product | HTML <summary> table → Product row (must be “Gentoo Security”) |
| Component | HTML <summary> table → Component row (must be “Vulnerabilities”) |
| Status | HTML <summary> table → Status row |
| Resolution | HTML <summary> table → Resolution row |
| Priority/Severity | HTML <summary> table → respective rows |
| AssignedTo | HTML <summary> table → AssignedToName row |
| ReportedBy | HTML <summary> table → ReportedByName row |
| Author | <author><name> element |
| CVE IDs | All CVE-\d{4}-\d{4,} matches in title, deduped (usually empty) |
| Creation Date | HTML <summary> table → Creation date row, with fallback to <updated> |
| Updated | <updated> ISO 8601 timestamp |
| Content Hash | SHA1(id|updated|summary) |
ID Generation
Each bug is assigned a GENTOO-{year}-{bugID} identifier:
- Extract bug ID from URL (e.g.,
971278) - Extract year from the creation date timestamp
- Build cveId:
GENTOO-{year}-{bugID}(e.g.,GENTOO-2026-971278) - Build gcveId:
GCVE-110-GENTOO-{year}-{bugID} - Store GcveIssuance with
sequenceNumber = bugID(integer) - Link bug ID and any extracted CVE IDs as GcveAlias records
No sequence counter needed — bug IDs are deterministic from the feed.
Storage
No new tables or columns. All tables already exist.
| Table | Rows inserted |
|---|---|
CVEMetadata | One per security bug; source="gentoo", cveId="GENTOO-YYYY-{bugID}" |
CVEDescription | One per bug; containerType="cna", lang="en" |
CVEMetadataReferences | One per bug; type="issue", referenceSource="gentoo" |
CVEAffected | One per bug (when package atom is extractable); vendor="Gentoo", product=packageAtom |
GcveIssuance | One per bug; gcveId="GCVE-110-GENTOO-YYYY-{bugID}" |
GcveAlias | Bug ID + each extracted CVE ID linked to GCVE ID |
CVEAlias | Extracted CVE IDs linked to GENTOO identifier |
Incremental Strategy
On startup, load all sourceAdvisoryRef values from CVEMetadata where
source='gentoo' into a map[string]bool. Per bug: if the URL is in the
set and --all is false, skip.
Flags
| Flag | Default | Description |
|---|---|---|
--all | false | Reprocess all bugs, not just new ones |
--limit | 0 | Maximum bugs to process per run (0 = unlimited) |
--backfill | false | Use backfill feed URL (all bugs) instead of daily feed |
ECS Schedule
Runs weekly on Saturdays at 07:00 UTC (cron(0 7 ? * SAT *)).
Key Files
| File | Purpose |
|---|---|
cmd/gentoo-rss-processor/main.go | Main processor |
internal/gentoo/types.go | Atom feed and advisory Go structs |
internal/gentoo/parser.go | Feed parsing, HTML table extraction, CVE extraction |
internal/gentoo/mapper.go | Advisory → CVESourceData mapping |
schemas/gentoo_rss_advisory.schema.json | JSON Schema Draft 7 for parsed advisory object |
S3 Persistence
Not used. This processor does not currently archive payloads or quarantine failures to S3. Per the S3 Persistence Contract this is non-compliant — see the compliance matrix for the implementation roadmap.
Expected paths when implemented:
- Archive:
gentoo/files/{sha256}/{filename} - Quarantine:
failed-feeds/gentoo-processor/{YYYY-MM-DD}/{reason}/{filename} - Likely reasons:
parse-error