About

CSAF is a web-based management tool for creating, reading, updating, and deleting Common Security Advisory Framework (CSAF) documents conforming to OASIS CSAF versions 2.0 and 2.1.

Version 1.5.26

Features

• Full CRUD operations for CSAF security advisories, VEX, and informational advisories
• Built-in validation against CSAF 2.0/2.1 schema rules
• CVSS v3.1 and v4.0 scoring display
• Generate SHA-256 hashes sidecars (extension .sha-256)
• Generate SHA-512 hashes sidecars (extension .sha-512)
• Generate SHA3-512 hashes sidecars (extension .sha3-512)
• Generate BLAKE3-512 hashes sidecars (extension .blake3-512)
• Generate SHAKE256-512 hashes sidecars (extension .shake256-512)
• Bulk import/export with filesystem directory scanning
• Audit trail for all document operations
• HATEOAS-compliant REST API
• Embedded storage (redb + SQLite) — no external database required
• TLS 1.3 with automatic certificate generation

Standards

• OASIS CSAF 2.0
• OASIS CSAF 2.1

Source code

CSAF CRUD is free software under the Apache License 2.0. The complete source, issue tracker and release archives — including the five checksum sidecars published with every binary — live in the project repository. The workspace is also published to crates.io, so it can be built or installed from source with cargo install csaf-crud, or fetched pre-built with cargo binstall csaf-crud.

• Repository: https://gitlab.com/vPierre/ndaal_public_csaf_crud
• Releases: https://gitlab.com/vPierre/ndaal_public_csaf_crud/-/releases
• crates.io: csaf-crud · ndaal-csaf-cli · csaf-core · csaf-models

The SHA256SUMS manifest in each release is what this binary's own --self-update verifies a download against. That proves integrity, not authenticity — the artifacts are not signed, so whoever can rewrite a release archive at source can rewrite the manifest beside it.

Contact

Developed by ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG, Cologne, Germany.