Crate holger_intel 

holger-intel — offline vulnerability intelligence

Holger’s secure side never touches the internet, so its advisory database has to cross the airgap the same way a firmware release does:

 ONLINE                                     │ AIRGAP │            SECURE
 OSV all.zip ─┐                             │        │
 NVD 2.0 ─────┼─ normalize ─ AdvisorySet ─ sign ─ USB ─ verify ─ floor ─ audit ─ local DB ─ scan
 CISA KEV ────┘   (feeds)      (set)      (bundle)       (import)              (db)     (resolve)

• No new format. An intel bundle IS a holger.update-bundle/v1, with product = holger.intel/v1 (INTEL_PRODUCT). The advisory set is its one payload (payload/advisories.json); the per-feed source record is its Advisory evidence. The release manifest hashes every member (SHA-256 + BLAKE3), the release signature covers the manifest, and the same trust policy, two-person rule, trusted clock and anti-rollback floor apply.
• Anti-rollback. core.sequence is monotonic per (supplier, holger.intel/v1); [import] refuses a lower sequence, a same-sequence replay with other bytes and an absent floor without first_import, through update-bundle’s RollbackStore.
• Fail-closed audit. [import] writes its audit record before the floor moves and before the new set goes live; a sink that is off or fails refuses the import and leaves the database as it was.
• Staleness. The evidence names the bundle sequence and snapshot date; stale::StalenessRule warns after N days and blocks after M.
• Offline proof. net::IntelNet::offline refuses every URL. The default build of this crate links no HTTP client at all; fetch adds ureq for the online side only.

Re-exports

pub use bundle::build_bundle;

pub use bundle::BuildOptions;

pub use bundle::BuiltBundle;

pub use bundle::SignerFiles;

pub use db::InstalledIntel;

pub use db::LocalIntelDb;

pub use feeds::FeedKind;

pub use feeds::FeedSpec;

pub use feeds::RawFeed;

pub use import::commit;

pub use import::import;

pub use import::prepare;

pub use import::ImportAudit;

pub use import::ImportOutcome;

pub use import::ImportRecord;

pub use import::ImportRequest;

pub use import::Prepared;

pub use import::PreparedImport;

pub use import::PREPARED_SCHEMA;

pub use net::Fetch;

pub use net::IntelNet;

pub use net::NetError;

pub use resolve::fold_staleness;

pub use resolve::resolve;

pub use resolve::resolve_local;

pub use resolve::scan_against;

pub use resolve::IntelEvidence;

pub use resolve::IntelScanner;

pub use resolve::IntelSettings;

pub use resolve::IntelVerdict;

pub use resolve::LiveIntel;

pub use resolve::ResolvedAdvisories;

pub use set::AdvisorySet;

pub use set::IntelAdvisory;

pub use set::SourceRecord;

pub use stale::Staleness;

pub use stale::StalenessRule;

pub use chrono;

pub use modgunn;

Modules

bundle

The online side’s last step: an AdvisorySet becomes a signed holger.update-bundle/v1 with product = holger.intel/v1.

db

The persistent local advisory database on the secure side.

feeds

The three upstream feeds and their normalization into one AdvisorySet.

import

The secure side’s door: verify a carried intel bundle, hold it to the anti-rollback floor, record it in the audit log, and only then make its advisory set the live local database.

net

The network gate. Every byte this crate could ever pull from outside goes through IntelNet::get, and an offline gate refuses every URL before any socket exists.

resolve

Where a scan’s advisories come from, and the evidence that says so.

set

The normalized advisory set: one compact, deterministic JSON document that every feed folds into, and that both sides of the airgap agree on.

sigs

Scanner signatures (ClamAV, YARA) as a signed bundle (lane HOL-NCSC). Scanner signatures across the airgap (lane HOL-NCSC, NCSC P2/P3): ClamAV’s signature databases (and YARA rules) carried as a signed holger.update-bundle/v1 with product = holger.scanner-sigs/v1 (SIGS_PRODUCT), exactly as intel is.

stale

How old an advisory database may get before a scan against it says so, and before it stops being an answer at all.

subject

What a file on disk is, for a scan with no server around it: a wheel’s own METADATA first, then the name-version.ext file name.

Constants

ADVISORIES_MEDIA_TYPE

Its media type.

ADVISORIES_REL

The bundle member that carries the normalized advisory set.

DEFAULT_SUPPLIER

The supplier an intel bundle names when the builder is not told another.

INTEL_PRODUCT

The core.product every intel bundle carries. The anti-rollback floor is kept per (supplier, product), so this is what makes the intel sequence its own monotonic line, separate from any firmware product.

SOURCES_REL

The evidence member that records, per feed, where it came from and its hash.