About CSAF
CSAF is a web-based management tool for creating, reading, updating, and deleting Common Security Advisory Framework (CSAF) documents conforming to OASIS CSAF versions 2.0 and 2.1.
Version 1.4.12
Features
- Full CRUD operations for CSAF security advisories, VEX, and informational advisories
- Built-in validation against CSAF 2.0/2.1 schema rules
- CVSS v3.1 and v4.0 scoring display
- SHA-256 and SHA3-512 sidecar hash file generation
- Bulk import/export with filesystem directory scanning
- Audit trail for all document operations
- HATEOAS-compliant REST API
- Embedded storage (redb + SQLite) — no external database required
- TLS 1.3 with automatic certificate generation
Standards
Source code
CSAF CRUD is free software under the Apache License 2.0. The complete
source, issue tracker and release archives — including the five checksum
sidecars published with every binary — live in the project repository.
The workspace is also published to crates.io, so it can be built or
installed from source with
cargo install csaf-crud, or fetched pre-built with
cargo binstall csaf-crud.
- Repository: https://gitlab.com/vPierre/ndaal_public_csaf_crud
- Releases: https://gitlab.com/vPierre/ndaal_public_csaf_crud/-/releases
- crates.io: csaf-crud · ndaal-csaf-cli · csaf-core · csaf-models
The SHA256SUMS manifest in each release is what this
binary's own --self-update verifies a download against. That
proves integrity, not authenticity — the artifacts are not
signed, so whoever can rewrite a release archive at source can rewrite the
manifest beside it.
Contact
Developed by ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG, Cologne, Germany.