OpenJS CNA API to support project operations

[UlisesGascon]

The main goal is to enable projects such as Node.js to use our API the same way they use HackerOne (compatibility layer). Also any other foundation project can use the HTTP API to manage their own CVEs. There are quite interesting features included in the API from the CNA perspective like credentials segmentation or guardrails on the payloads. This will help us to make easier for us to delegate the CVE management responsibility to the projects.

As Node.js will require the most complex compatibility layer, I will also contribute to the project the changes needed to use our API with minimal disruption on the current Security Release process (nodejs/security-wg#1570).

We did the kick off officially on #338. So here you can find:

• Presentation + demo: https://youtu.be/HkePMUn0rKs?si=9eHqP0wXPrI-ISC-&t=242
• Slides: https://slides.ulisesgascon.com/openjs-cna-api-kick-off/
• API POC repo:
  • Docs: https://github.com/UlisesGascon/openjs-cna-api-poc/blob/main/README.md
  • Architecture (diagrams, constraints, FAQ, Mitre limits, etc..): https://github.com/UlisesGascon/openjs-cna-api-poc/blob/main/docs/architecture.md
  • Deployment details: https://github.com/UlisesGascon/openjs-cna-api-poc/blob/main/docs/deployment.md
• official clients:
  documentation: https://github.com/UlisesGascon/openjs-cna-tools

Backlog

Phase 0: Prepare the repo

Goals
In order to make the API work we need to migrate the current CNA repo stack to Node.js from Jekyll. In this opportunity window we can do other changes. The idea is to create small PRs porting changes from https://github.com/UlisesGascon/openjs-cna-api-poc to https://github.com/openjs-foundation/security-advisories

Backlog

• Site migrated from Jekyll to Eleventy (using the same theme): https://github.com/openjs-foundation/security-advisories/pull/81
• Create a dedicated account with access to MITRE
• MITRE as the data source: Published CVEs are pulled from MITRE CVE Services on a periodic refresh. No manually maintained YAML file: https://github.com/openjs-foundation/security-advisories/pull/82
• Update the reserved CVEs list issue: https://github.com/openjs-foundation/security-advisories/pull/83
• Match published CVEs to their GitHub advisories: https://github.com/openjs-foundation/security-advisories/pull/84
• Agree in final architecture decisions: https://github.com/openjs-foundation/security-advisories/pull/89
• A public Open Data feed: /security-advisories.json (and the existing RSS) expose the full published-advisory list to programmatic consumers.
• Include all the CVEs/advisories made for the OpenJS projects and list them in /security-advisories.html with a clear visual difference
  • Extend the POC to showcase this info.

Discussions

• Do we want to list all the CVEs/advisories related to the OpenJS projects listed within the CNA website even if we are not the issuers as technically the projects are under our CNA scope

Decisions made
Waiting for discussions

Phase 1: Build the API

Goals
We need to agree on the final architecture and deliver it

Backlog

• Port the documentation to the CNA repo to enable the discussion
• Once the documentation and specs are clear adapt the existing POC
• Port the API from the POC repo to the CNA Repo
• Create testing credentials for Node.js projects (unblock phase 2)

Discussions

• Are we happy with the current proposal ref?

Decisions made
Waiting for discussions

Phase 2: Enable Node.js

Goals
Once the API is clear, the goal is to integrate the OpenJS CNA within the existing tools and process for the Node.js team

Backlog

• Create a Node.js Security WG initiative around the adoption (docs: add initiative adopt OpenJS CNA for CVE Operations nodejs/security-wg#1570)
• Update Node.js Security process documentation (doc: document OpenJS CNA publication step in security release nodejs/node#63894)
• Add support to the OpenJS CNA to NCU (Support OpenJS Foundation CNA as CVE source nodejs/node-core-utils#1093)

Discussions

• Clarify with @RafaelGSS the HackerOne data format
• How do we want to test this? How the testing environment looks like?
• Do we need a TSC approval?
• When is a good moment to change CNA?

Decisions made
Waiting for discussions

Phase 3: Enable for other projects

Goals

The main goal is to onboard existing projects to the API and decide if we want to support an official client or not.

Backlog

• Update the CLI/library to include/remove features
• Transfer the repo (https://github.com/UlisesGascon/openjs-cna-tools) to the OpenJS Org
• Publish the package on npm
• Onboard the first projects

Discussions

• Do we need a staging are for any CVE change? Then the CNA coordinators can approve the changes/publication?
• Do we want to maintain an official client for the teams? In that case https://github.com/UlisesGascon/openjs-cna-tools is a good option?
• What are our opinionated rules on top of MITRE?
• What projects should be using the API? Undici, Fastify and Express are heavy users of the CNA on regular bases.

Decisions made
Waiting for discussions

[mcollina]

As a second step, having a UI for quickly creating those would be useful.

[UlisesGascon]

As a second step, having a UI for quickly creating those would be useful.

@RafaelGSS did demoed a full UI for the triage process (ref private link). I think that nodejs/node-core-utils#1093 will be compatible with that out-of-the-box 🤔

In the meantime I was working on https://github.com/UlisesGascon/openjs-cna-tools that mimics NCU but for doing CNA operations. Should be 4 commands to reserve, convert an advisory, review and publish a CVE for the foundation projects but the proposal is an alpha version.