From: Thomas Petazzoni via buildroot <buildroot@buildroot.org>
To: Daniel Lang <dalang@gmx.at>
Cc: buildroot@buildroot.org
Subject: Re: [Buildroot] [PATCH] support/scripts/cve.py: switch to NVD JSON version 2.0
Date: Tue, 1 Aug 2023 21:44:33 +0200 [thread overview]
Message-ID: <20230801214433.64c77f3a@windsurf> (raw)
In-Reply-To: <d2033d92-cb45-ccbf-b3f8-05e0fdbda360@gmx.at>
Hello Daniel,
On Tue, 1 Aug 2023 16:44:12 +0200
Daniel Lang <dalang@gmx.at> wrote:
> I disabled all parts that would request information online during execution
> to get a more predictable timing information.
Sure.
> To be honest I didn't check if the CPE feed is deprecated as well.
> But looking at the feed's website (https://nvd.nist.gov/products/cpe) it
> seems like it will be retired as well in favor of running delta updates
> via an API (https://nvd.nist.gov/developers/products).
>
> The "problem" is that NVD currently tracks 1M CPEs and the API returns
> 10k at a time.
Gah. I'm not sure this API thing is really a win compared to the good
old way of providing a database dump (JSON blob or anything similar).
> Saving them one by one into a file won't make much sense.
> Another idea is to put them in an array and save it as a big json file.
> When updating one has to make sure that entries are unique.
How do you know which ones to retrieve? You can request them by
timestamp or something, to ensure your local copy has all entries,
without having to redownload them all?
> I will send a separate patch once I have that part updated as well.
Awesome, thanks a lot for working on this!
Thomas
--
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
next prev parent reply other threads:[~2023-08-01 19:44 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-07-31 20:14 [Buildroot] [PATCH] support/scripts/cve.py: switch to NVD JSON version 2.0 Daniel Lang
2023-07-31 21:52 ` Thomas Petazzoni via buildroot
2023-08-01 14:13 ` Daniel Lang
2023-08-01 14:19 ` Thomas Petazzoni via buildroot
2023-08-01 14:44 ` Daniel Lang
2023-08-01 19:44 ` Thomas Petazzoni via buildroot [this message]
2023-08-01 19:55 ` Daniel Lang
2023-08-09 20:31 ` Arnout Vandecappelle via buildroot
2023-08-09 20:59 ` Thomas Petazzoni via buildroot
2023-08-10 5:50 ` Daniel Lang
2023-08-10 7:07 ` Thomas Petazzoni via buildroot
2023-08-10 13:18 ` Arnout Vandecappelle via buildroot
2023-08-10 13:42 ` Thomas Petazzoni via buildroot
2023-08-10 14:58 ` Arnout Vandecappelle via buildroot
2023-08-10 20:12 ` Daniel Lang
2023-08-10 21:12 ` Thomas Petazzoni via buildroot
2023-08-11 6:51 ` Arnout Vandecappelle via buildroot
2023-08-11 12:30 ` [Buildroot] [External] " Weber, Matthew L Collins via buildroot
2023-08-10 20:02 ` [Buildroot] " Daniel Lang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230801214433.64c77f3a@windsurf \
--to=buildroot@buildroot.org \
--cc=dalang@gmx.at \
--cc=thomas.petazzoni@bootlin.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox