usn-resource

A read-only (no put) Concourse resource for tracking Ubuntu Security Notices

Source Configuration

• os - Ubuntu release codename to track, e.g. jammy, noble, resolute.

  Used verbatim to address Canonical’s OVAL data, which is keyed by codename: https://security-metadata.canonical.com/oval/com.ubuntu.<os>.usn.oval.xml.bz2. Browse the feed index for the releases currently published; interim releases appear alongside LTS ones.

  Version numbers such as ubuntu-24.04-lts are not accepted. Canonical has never published OVAL data under that form; earlier versions of this resource translated a hardcoded handful of them to codenames, which broke every time a new Ubuntu release appeared.

• priorities - list of Ubuntu CVE priorities to trigger on, including:

  • low
  • medium
  • high
  • critical
  • unknown when CVE reference gives http error

• severities - list of CVSS CVE severities to trigger on, including:

  • low
  • medium
  • high
  • critical

• fetch_attempts - optional, default 10. How many times in downloads the OVAL feed looking for the USN that check found. Canonical’s cache nodes can lag each other, so a fresh download may be missing a new USN or its CVEs. Retries back off exponentially from 30s, capped at 10m, so the default gives up after about an hour.

The resource will trigger if either the configured priorities or severities match a usn. For example, https://ubuntu.com/security/CVE-2025-9230 has a CVSS severity of high but a Ubuntu priority of medium.

The following configuration would NOT trigger for CVE-2025-9230:

- name: high-critical-priority
  type: usn
  source:
    os: ubuntu-22.04-lts
    priorities:
    - high
    - critical

whereas the following configuration WOULD:

- name: high-critical-priority
  type: usn
  source:
    os: ubuntu-22.04-lts
    priorities:
    - high
    - critical
    severities:
    - high

check

Check for new USNs.

Metadata:

• guid - URL to USN page

in

Download USN contents.

• .resource/usn.json - json file with the USN details

out

Not a thing for this read-only resource.

License

Apache License 2.0

Development

• To run tests, use go run github.com/onsi/ginkgo/v2/ginkgo --keep-going --trace --race -vv -r from the root of the repository.