Not able to download repository ref as a tarball

Hi Greg,

Thanks for the report. It seems this was an unintended change in launchpad's git hosting, but it's also unclear whether the prior behavior of making the snapshots available was intended as well.

Marking this as affecting launchpad itself, so that the launchpad developers can make a determination as to whether it's something they should address.

Thanks again.

We haven't yet decided what we want to do here; but I do have some concerns, because the snapshots feature isn't particularly lightweight and this one repository is already a major drain on our available resources. In particular, since we never explicitly configured cgit snapshots, I believe the caching behaviour was cgit's default, i.e. to cache a snapshot for five minutes - not great for something the size of ubuntu-cve-tracker, but I'm also unsure whether we'd risk the potential of some kind of denial of service by tweaking this.

Have you considered using the exported OVAL data instead? My understanding is that that's usually what we recommend for things like security scanners rather than fetching the repository directly.

Thanks for the quick response.

I wasn't aware of that approach, where is the exported OVAL file? We currently are parsing all "CVE-.." files located under the "active" and "retired" folders (since we are also doing recalls in our DB). If there is a better way to gather that info, then we can definitely give it a go. Otherwise, we may end up using "libgit2sharp" to fetch content of those items but I agree it will be far more burden on the service at large scale.

I'm not authoritative on this, but I think that https://security-metadata.canonical.com/oval/ is the place to look.

Thanks for sharing, we are looking to capture just the CVEs and impacted versions + patches available if any.

The OVAL data has far more metadata than we need, and all of its properties would need to be sanitized to make them generic enough, otherwise we would end up storing multiple entries in our advisory cache for the exact same item, just different release which we want to avoid. The CVE files you have in ubuntu-cve-tracker are perfect for this requirement. We don't even need to know the release beforehand since the CVE file will organically include new ones.