diff --git a/.github/actions/spelling/allow.txt b/.github/actions/spelling/allow.txt index f16f01001d..dda213b9d5 100644 --- a/.github/actions/spelling/allow.txt +++ b/.github/actions/spelling/allow.txt @@ -175,6 +175,7 @@ expat Exploitablity f faad +facebook fastd fde fedora @@ -431,6 +432,7 @@ mysql Mystylesheet MYUSERNAME namespaces +namespace nano nasm nbd diff --git a/data/pypi/zstandard/mismatch_relations.yml b/data/pypi/zstandard/mismatch_relations.yml new file mode 100644 index 0000000000..e329790713 --- /dev/null +++ b/data/pypi/zstandard/mismatch_relations.yml @@ -0,0 +1,4 @@ +purls: + - pkg:pypi/zstandard +invalid_vendors: + - facebook diff --git a/doc/index.rst b/doc/index.rst index 084e8a93e1..6b959f5279 100644 --- a/doc/index.rst +++ b/doc/index.rst @@ -24,6 +24,7 @@ The CVE Binary Tool helps you determine if your system includes known vulnerabil sboms_for_humans/README.md new-contributor-tips.md pypi_downloads.md + mismatch_data.md Indices and tables ================== diff --git a/doc/mismatch_data.md b/doc/mismatch_data.md new file mode 100644 index 0000000000..1e8393bf1c --- /dev/null +++ b/doc/mismatch_data.md @@ -0,0 +1,47 @@ +# Adding data to mismatch database + +CVE Binary Tool uses a number of sources for vulnerability and risk data. Sometimes these can produce name collision, and to tackle this we've created a `mismatch` +database. + +This document details the steps for adding data to the mismatch database. + +## 1. Update `data/` directory + +1. Make a new file with `namespace/product_name/mismatch_relations.yml` name under the `data/` directory. For example, `pypi/zstandard/mismatch_relations.yml` for zstandard +from pypi namespace. +2. Populate the file with `purl-invalid_vendor` information. + +```yml + purls: + - pkg:pypi/zstandard + invalid_vendors: + - facebook +``` + +## 2. Run the populator script + +The [`mismatch_loader`](../cve_bin_tool/mismatch_loader.py) script populates the the mismatch database with the contents of `data/` directory. + +```python + python -m cve_bin_tool.mismatch_loader +``` + +The default directory is `data/`, and default database file is `cve.db`. + +To use a specific directory, use `--dir` flag: +```python + python -m cve_bin_tool.mismatch_loader --dir directory_location +``` + +To use a specific database file, use `--database` flag: +```python + python -m cve_bin_tool.mismatch_loader --database database_file_location +``` + +## 3. (optional) Make pull request of new-found name collision + +If you find invalid relationship, please do following: + +- Fork the [repo](https://github.com/intel/cve-bin-tool) +- Update the `data/` directory with purl-invalid_vendor information like [this](../data/pypi/zstandard/mismatch_relations.yml) +- Create a pull request with the details of update. [Reference](https://github.com/intel/cve-bin-tool/pull/4239)