mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-01 21:23:51 -09:00
6762c42e74
Enriches the input CycloneDX SBOM with vulnerability information and analysis from the NVD database. The NVD database is cloned using a mirror of it and the content is compared locally. By default the path 'dl/buildroot-nvd' is used. Example usage to analyse vulnerabilities of an input CycloneDX SBOM: $ make show-info | utils/generate-cyclonedx | support/script/cve-check The 'cve-check' can also be used to only enrich the vulnerabilities present on the input SBOM with a set metadata (description, cvss, references, ...) without applying an analysis. With the following command the vulnerabilities ignored by Buildroot present in the CycloneDX SBOM are enriched with description, cvss, etc ... $ make show-info | utils/generate-cyclonedx | support/script/cve-check --enrich-only Signed-off-by: Thomas Perale <thomas.perale@mind.be> [Peter: fix minor flake8 issues] Signed-off-by: Peter Korsgaard <peter@korsgaard.com>