psf-rhsa(8)
usage: rhsa.py [-h] [--version]
{find,verify,fetch,index,docs,audit,stats} ...
Find Red Hat security advisories, check installed packages against
them, and keep the READMEs up to date.
positional arguments:
{find,verify,fetch,index,docs,audit,stats}
find advisories for CVEs
verify installed packages against the fixes
fetch download Red Hat's list (needs the network)
index build the index from Red Hat's list
docs write or check the README sections
audit check the repository against the index
stats what the index holds
options:
-h, --help show this help message and exit
--version show program's version number and exit
usage: rhsa.py find [-h] [--list LIST] [--live] [--url URL]
[--index INDEX] [--stream STREAM]
[--package PACKAGE] [--json] [--limit LIMIT]
cve [cve ...]
Which advisories name a CVE, for which stream, and which package
release fixes it. Exit 1 when nothing is found.
positional arguments:
cve CVE ids, for example CVE-2026-98432
options:
-h, --help show this help message and exit
--list LIST search Red Hat's full list (a CSV or JSON file)
instead of the index
--live ask Red Hat's Security Data API (needs the
network)
--url URL the Security Data API address (default: Red
Hat's)
--index INDEX the index file (default: data/rhsa-index.json
next to this script)
--stream STREAM one stream, for example 9.6 or 'RHEL 9.6'
--package PACKAGE a pattern for the package name
--json print the records as JSON
--limit LIMIT packages shown per advisory
usage: rhsa.py verify [-h] [--rpm [RPM ...]] [--cve CVE] [--all]
[--list LIST] [--max-packages MAX_PACKAGES]
[--index INDEX]
[nevra ...]
Is an installed package at or after Red Hat's fix? Exit 1 when one is
older.
positional arguments:
nevra package names as name-[epoch:]version-
release[.arch], or - to read them from
standard input
options:
-h, --help show this help message and exit
--rpm [RPM ...] read the packages from rpm: the ones named, or
all when none is named
--cve CVE only this CVE (repeat it for more)
--all also show packages no advisory names
--list LIST use Red Hat's list (a file from fetch) instead
of the index, for every CVE in it
--max-packages MAX_PACKAGES
trust an advisory to pair a package with a fix
only when it lists this many source packages
or fewer (default 8)
--index INDEX the index file (default: data/rhsa-index.json
next to this script)
usage: rhsa.py fetch [-h] --after AFTER [--before BEFORE] --out OUT
[--merge MERGE] [--url URL] [--per-page PER_PAGE]
Download Red Hat's list of security advisories from its Security Data
API into a JSON file that index, find --list and verify --list can
read.
options:
-h, --help show this help message and exit
--after AFTER released on or after this date, YYYY-MM-DD
--before BEFORE released before this date, YYYY-MM-DD
--out OUT write the list to this file
--merge MERGE add the new advisories to this existing list
first
--url URL the Security Data API address (default: Red
Hat's)
--per-page PER_PAGE records asked for per request
usage: rhsa.py index [-h] [--repo REPO] [--cve CVE] [--all]
[--out OUT] [--placement PLACEMENT]
list [pairs]
Build the small index the other commands work from: the advisories for
the CVEs the READMEs name, or for every CVE with --all.
positional arguments:
list Red Hat's list, a CSV or JSON file
pairs Red Hat's list of advisory and CVE pairs;
optional, only compared with the list
options:
-h, --help show this help message and exit
--repo REPO the repository folder that holds the tool
READMEs (its CVEs are kept as well as those in
the placement table)
--cve CVE keep this CVE too (repeat it for more)
--all keep every CVE in the list, not only those the
READMEs name
--out OUT write the index here (default: the index file)
--placement PLACEMENT
the placement table (default: placement.json
next to this script)
usage: rhsa.py docs [-h] [--index INDEX] [--placement PLACEMENT]
--repo REPO (--write | --check)
Write the Red Hat advisories section of each README that the placement
table names, and REDHAT-ADVISORIES.md; or list what is out of date.
options:
-h, --help show this help message and exit
--index INDEX the index file (default: data/rhsa-index.json
next to this script)
--placement PLACEMENT
the placement table (default: placement.json
next to this script)
--repo REPO the repository folder that holds the tool
READMEs
--write write the sections
--check list what is out of date; exit 1 if anything
is
usage: rhsa.py audit [-h] [--index INDEX] [--placement PLACEMENT]
--repo REPO
Check the repository against the index: sections up to date, every CVE
with an advisory placed or excluded on purpose, every advisory id
cited anywhere in the data. Exit 1 on a problem.
options:
-h, --help show this help message and exit
--index INDEX the index file (default: data/rhsa-index.json
next to this script)
--placement PLACEMENT
the placement table (default: placement.json
next to this script)
--repo REPO the repository folder that holds the tool
READMEs
usage: rhsa.py stats [-h] [--index INDEX]
Print what the index holds: advisories, CVEs, severities and streams.
options:
-h, --help show this help message and exit
--index INDEX the index file (default: data/rhsa-index.json next to
this script)The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.
