Appendix: advisory change detection

This optional reference is for instructors and automation authors. It shows how the supplied polling helper can detect a change in an OSV repository manifest. The core workshop uses the local sample advisory in module 2.2 and does not require live polling.

Understand the signal

The helper requests PULP_MANIFEST from a configured OSV base URL and compares its SHA-256 checksum with a saved value. A changed checksum tells you that the manifest changed. It does not identify an applicable fix, verify an advisory’s authenticity, or authorize a production deployment.

Detect a manifest change then review the affected package and fixed version before proposing and testing a source update

Use a reachable repository that actually serves this manifest and for which you have access. The seeded Nexus sample documents do not establish that a live manifest is available. The configured Java OSV reference is https://packages.redhat.com/lightwell/osv/java/remediated; confirm the endpoint and access requirements before using it in customer automation.

Inspect the supplied helper

The application template includes tools/osv-eval/scripts/poll-pulp-manifest.sh. In the existing Showroom application clone, inspect it before running it. If the file is absent, use this appendix as a design reference rather than attempting commands from another repository.

cd /home/lab-user/lightwell-workspace/spring-boot-lw-poc
test -f tools/osv-eval/scripts/poll-pulp-manifest.sh
sed -n '1,180p' tools/osv-eval/scripts/poll-pulp-manifest.sh

The helper requires Bash, curl, sha256sum, and standard shell utilities. It reads optional credentials from LW_USERNAME and LW_PASSWORD; keep those out of source and shared output. Its optional webhook path also requires Python, but the example below leaves notifications disabled.

Optional: run one comparison

Enter the authorized repository’s OSV base URL. Use a separate state directory for each source so checksums from unrelated repositories are never compared. Run from a terminal where the required network access and credentials are already configured.

read -r -p 'Authorized OSV base URL: ' OSV_BASE
export OSV_BASE
export STATE_DIR="$HOME/.cache/lightwell-osv-review"
WEBHOOK_URL='' INTERVAL_SEC=0 bash tools/osv-eval/scripts/poll-pulp-manifest.sh
POLL_STATUS=$?
printf 'Polling exit status: %s\n' "$POLL_STATUS"
Observation Meaning

First successful request, exit 0

The helper saves a baseline checksum. This is initialization, not a newly discovered remediation.

No change, exit 0

The fetched manifest matches that baseline.

Changed-content message, exit 2

The helper updates the stored checksum and reports a change. Treat exit 2 as a change signal when integrating this script into automation.

Fetch or execution error

There is no usable comparison. Inspect the error and repair access or tooling before retrying.

The helper’s first-20-lines output is a preview, not a diff of added records. For reliable automation, retain previous manifests, compare entries, and preserve a processing record. The helper updates its checksum before an optional notification; it is not a durable work queue.

Review before proposing an update

  1. Retrieve the changed advisory through the approved source.

  2. Match its package identity to a dependency in your application inventory.

  3. Read the relevant affected range and exact fixed version, as in 2.2.

  4. Propose the source change for review and run application tests.

  5. Build, sign, and evaluate the resulting image before GitOps promotion.

  6. Refresh the inventory and advisory assessment for the promoted digest.

Schedule polling and connect notifications only after defining ownership, retry behavior, authentication, and duplicate-event handling. This appendix does not configure a scheduler, create tickets, or trigger builds.