usn-resource

A read-only (no put) Concourse resource for tracking Ubuntu Security Notices

Source Configuration

• os - Ubuntu release codename to track, e.g. jammy, noble, resolute.

  Used verbatim to address Canonical’s OVAL data, which is keyed by codename: https://security-metadata.canonical.com/oval/com.ubuntu.<os>.usn.oval.xml.bz2. Browse the feed index for the releases currently published; interim releases appear alongside LTS ones.

  Version numbers such as ubuntu-24.04-lts are not accepted. Canonical has never published OVAL data under that form; earlier versions of this resource translated a hardcoded handful of them to codenames, which broke every time a new Ubuntu release appeared.

• priorities - list of Ubuntu CVE priorities to trigger on, including:

  • low
  • medium
  • high
  • critical
  • unknown when CVE reference gives http error

• severities - list of CVSS CVE severities to trigger on, including:

  • low
  • medium
  • high
  • critical

The resource will trigger if either the configured priorities or severities match a usn. For example, https://ubuntu.com/security/CVE-2025-9230 has a CVSS severity of high but a Ubuntu priority of medium.

The following configuration would NOT trigger for CVE-2025-9230:

- name: high-critical-priority
  type: usn
  source:
    os: ubuntu-22.04-lts
    priorities:
    - high
    - critical

whereas the following configuration WOULD:

- name: high-critical-priority
  type: usn
  source:
    os: ubuntu-22.04-lts
    priorities:
    - high
    - critical
    severities:
    - high

check

Check for new USNs.

Metadata:

• guid - URL to USN page

in

Download USN contents.

• .resource/usn.json - json file with the USN details

out

Not a thing for this read-only resource.

License

Apache License 2.0

Development

• To run tests, use go run github.com/onsi/ginkgo/v2/ginkgo --keep-going --trace --race -vv -r from the root of the repository.