vultr-fetch-processor — Design (RETARGETED — commentary enricher, low priority)

Status: RETARGETED, defer build. Vultr publishes <5 CVE-mentioning blog posts per year. Volume is too low to justify scheduling; this design is recorded so any future “let’s add Vultr” discussion can short-circuit to “yes, here’s how, but the cost/benefit doesn’t justify code today”.

1. Overview

  • Tier: Tier-2 IaaS (Phase 4)
  • Verdict: RETARGETED to commentary enricher, build deferred until volume justifies
  • Reason in one sentence: blogs.vultr.com posts an occasional vulnerability response article (Spectre/Meltdown, VENOM) that references third-party CVE IDs, but no first-party advisory feed exists and historical volume is <5 posts/year.
  • Extended dictionary already authored: internal/critutil/dictionaries/extended/vultr.json (§15.2). Service entries valid; would be consumed if a future Vultr first-party feed appears.
  • Implied processor type: fetch (HTML scrape, paginated index)

2. Source contract (Phase 0 recon — 2026-05-08)

Recon-protocol grid:

StepCheckFinding
1First-party CSAFNone
2First-party CVRFNone
3First-party RSS / AtomNone on vultr.com or blogs.vultr.com
4First-party JSON APIstatus.vultr.com exposes status.json and alerts.json but they carry zero security content
5First-party HTML listingblogs.vultr.com/ exists; no /category/security/ taxonomy; vulnerability-response posts are scattered (slug-based, not categorised)
6GitHub Security Advisoriesgithub.com/vultr exists; no Security Advisories tab usage
7CVE alias presenceConfirmed on a few historical posts (Intel CPU Vulnerability Alert: CVE-2017-5753 / -5715 / -5754; VENOM Vulnerability Response)
8Anti-botNone observed on blogs.vultr.com (plain HTML, no JS gating); vultr.com/blog/ rate-limits anonymous fetch (HTTP 429) but the blog content itself lives on the separate host

URLs checked:

  • https://www.vultr.com/security/ — 404
  • https://status.vultr.com/ — 200; operational only
  • https://www.vultr.com/blog/category/security/ — 404
  • https://www.vultr.com/blog/ — 429 (rate-limited)
  • https://docs.vultr.com/platform/customer-advisory — 200; operational advisories (“VoIP”, “BYOIP”), zero CVE IDs
  • https://blogs.vultr.com/ — 200; no security category, no RSS link
  • https://blogs.vultr.com/Intel-CPU-Vulnerability-Alert — 200; references CVE-2017-5753/5715/5754; published 2018-01-04
  • https://blogs.vultr.com/VENOM-Vulnerability-Response — referenced via search

3. Architecture (if built)

Same shape as the proposed digitalocean-fetch-processor: paginate the blogs.vultr.com/ index, regex-extract CVE-YYYY-NNNN+ from post title/body, attach as third-party-analysis reference rows per matching CVEMetadata source. Skip posts without CVE matches. No optional CRIT — Vultr commentary doesn’t claim product mitigation detail rich enough to support a not_affected envelope.

4. Source → DB field mapping

CVEMetadata: none written.

CVEMetadataReferences: one row per (cveId, source) already in CVEMetadata, with type="third-party-analysis", referenceSource="vultr".

5. Identifier policy

No Vultr-issued IDs. Regex CVE-\d{4}-\d{4,7} over post title + first paragraph.

6. CRIT / VEX

Out of scope. Volume too low to make a CRIT envelope authoring worthwhile.

7. S3 layout

Per AGENTS.md:

  • Archive: vultr/files/{sha256}/{post-slug}.html
  • Quarantine: failed-feeds/vultr-fetch-processor/{date}/{reason}/{filename}

8. Error handling

Best-effort; blogs.vultr.com HTML changes are likely to break the listing regex. Quarantine on parse failure.

9. Performance

CPU 256, memory 512 MB. Cron: monthly (0 12 1 * ? *) — once-a-month sweep is enough given the post cadence.

10. Backfill

go-vultr-fetch-backfill TARGET FORCE LIMIT mirroring fastly. No EMIT_CRIT arg (CRIT path not built).

11. Defer rationale

Why deferred from immediate build:

  • ≤5 commentary posts/year × ≤3 CVE refs each = ≤15 reference rows/year
  • The same CVEs (CPU side-channels, ESXi escapes, container runtime CVEs) are already covered by cisa-kev, nist-nvd, and enrich-references-fetch at higher fidelity
  • The chosen CRIT pipeline value-add (per-(cveId, provider, service) envelopes) requires structured advisory data that Vultr does not publish

What would unblock build:

  • Vultr standing up vultr.com/security/ with CVE-prefixed bulletins and an RSS feed, OR
  • A customer specifically requesting Vultr citations on their CVE detail pages

Recheck cadence: every 12 months. Re-walk the URL grid; promote to “build now” if volume crosses 20 CVE-bearing posts/year.

S3 Persistence

Not used. This processor does not currently archive payloads or quarantine failures to S3. Per the S3 Persistence Contract this is non-compliant — see the compliance matrix for the implementation roadmap.

⚠ Not in the compliance matrix — status needs verification.

Expected paths when implemented:

  • Archive: vultr/files/{sha256}/{filename}
  • Quarantine: failed-feeds/vultr-fetch-processor/{YYYY-MM-DD}/{reason}/{filename}
  • Likely reasons: (none documented)