Chapter 3. Importers
As a systems administrator, you can add and manage existing data importers for Red Hat Trusted Profile Analyzer (RHTPA). Importers give you the ability to retrieve from different data sources to give you better insights to potential vulnerabilities within your software supply chain.
3.1. Automate data ingestion with importers Copy linkLink copied to clipboard!
You can use the Red Hat Trusted Profile Analyzer data importer to fetch advisory, vulnerability, and SBOM data from multiple remote sources for analysis. Then RHTPA uses this data to give you more insights when analyzing your Software Bill of Materials (SBOM) and Common Security Advisory Framework (CSAF) documents.
- Available importers
By default, RHTPA comes configured with the following importer sources:
- Red Hat CSAFs
- Red Hat SBOMs
- Common Vulnerabilities and Exposures (CVE) list version 5
- GitHub advisory database
- Quay
By default, the Red Hat CSAF, Red Hat SBOM, and Quay data importers are disabled. These importers can run a long time before finishing, but you can enable any of these data importers at anytime. The Quay data importer scans the Quay registry looking for existing SBOMs for RHTPA to analyze.
- Scheduling
- By default, the set schedule for each importer source to run is 1 day. This means an enabled importer source runs once a day. After a successful initial running of the importer, the next scheduled run is 24 hours from the time the importer job finished.
- Computing resources
Computing resources, and setting limitations on those resources in Red Hat OpenShift Container Platform is important to ensure the application runs stable and performs as expected. The default resource request is 1 CPU and 8 GB of RAM, for both the importer and API server deployments. There are no resource limits by default.
You can either reduce the resource requirements, at the cost of stability, or give more resources to the cluster, supporting the workload. Pods can fail to start, or become stuck in a "Pending" state, if computing requirements are not adequate to support the workload.
3.2. Configure an HTTP Pulp importer for Lightwell Copy linkLink copied to clipboard!
You can configure an HTTP Pulp importer to retrieve OSV advisory data from Lightwell’s Java Remediated endpoint.
The Lightwell integration is provided as a Technology Preview feature. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process.
Prerequisites
- Installation of RHTPA 3.1.1 or later on Red Hat OpenShift or Red Hat Enterprise Linux.
Procedure
Create the importer configuration:
Using the Operator CRD (JSON format):
{ "configuration": { "http": { "period": "1d", "source": "https://packages.redhat.com/api/pulp-content/public-lightwell-demo/osv/java/remediated/", "discovery": { "type": "pulp" } } } }Using Helm Charts (YAML format in
values-importers.yaml):redhat-lightwell-demo: http: disabled: false period: 1d source: https://packages.redhat.com/api/pulp-content/public-lightwell-demo/osv/java/remediated/ discovery: type: pulpThe importer will pick up this configuration and schedule a
1dperiod to run the import from the endpoint.
3.3. Configure vendor-specific package recommendations Copy linkLink copied to clipboard!
You can configure vendor-specific package recommendations for dependencies that follow a vendor build versioning convention. The recommendation engine matches package version strings against configured regex patterns to identify vendor builds.
Prerequisites
- Installation of RHTPA 3.1.1 or later on Red Hat OpenShift or Red Hat Enterprise Linux.
- HTTP Pulp importer configured with Lightwell pattern.
Procedure
Configure vendor-specific package recommendations through the
TRUSTD_RECOMMEND_PATTERNSenvironment variable or the--recommend-patternsCLI argument.The following examples show pattern configurations:
-
For Red Hat and Lightwell:
(.+)[.-]redhat-[0-9]+$,(.+)[.-]rhlw-[0-9]+$ -
For Red Hat only:
^(.+)[.-]redhat-[0-9]+$ -
For Lightwell only:
^(.+)[.-]rhlw-[0-9]+$
-
For Red Hat and Lightwell:
In the Helm Charts and in the Operator, configure the following parameter:
# Helm values.yaml modules: server: recommendPatterns: - "^(.+)[.-]rhlw-[0-9]+$"
Verification
You can verify that the server deployment contains the TRUSTD_RECOMMEND_PATTERNS environment variable with the expected value by using the CLI or using the OpenShift web console.
Using the CLI:
$ oc get deployment server -o jsonpath='{range .spec.template.spec.containers[*].env[?(@.name=="TRUSTD_RECOMMEND_PATTERNS")]}{.name}{"="}{.value}{"\n"}{end}'Example output:
TRUSTD_RECOMMEND_PATTERNS=^(.+)[.-]rhlw-[0-9]+$Using the OpenShift web console:
-
Navigate to Workloads
Deployments. -
Select the
serverdeployment. - Open the Environment tab.
-
Verify that the
TRUSTD_RECOMMEND_PATTERNSenvironment variable has the value^(.+)[.-]rhlw-[0-9]+$.
-
Navigate to Workloads
If TRUSTD_RECOMMEND_PATTERNS is not configured, the /purl/recommend endpoint returns a 503 error with the message "Endpoint disabled — TRUSTD_RECOMMEND_PATTERNS not configured", and the Generate remediations report button is hidden in the UI.