Notes on the ASF fork of Vulnogram

This fork adds a number of ASF-specific features, such as:

• authorization based on the ASF OAuth
• sending various notification emails
• selecting which fields to encourage
• some ASF-specific autocompletes and validations
• allocate CVEs server-side through the ASF CVE

Setting up a development environment

The recommended dev setup runs MongoDB in a container and the Vulnogram app on the host.

One-time setup

1. Install Node dependencies:

   npm install
   

2. Copy example-asf.env to .env, then open .env and uncomment the development overrides at the top of the file:

   cp example-asf.env .env
   

3. Generate a self-signed TLS certificate (required because the oauth.apache.org callback URL must use HTTPS):

   openssl req -x509 -newkey rsa:2048 -nodes \
     -keyout key.pem -out cert.pem -days 365 \
     -subj "/CN=localhost" \
     -addext "subjectAltName=DNS:localhost,IP:127.0.0.1"
   

   The browser will warn about the untrusted certificate on first visit; click through to accept it.

Every run

1. Start MongoDB in a container:

   docker compose up -d vulnogram-mongo
   

2. Start the app on the host:

   node app.js
   

The app listens on http://0.0.0.0:3555 by default and uses oauth.apache.org for authentication.