Google Git
Sign in
go / vuln / bcd0039f11a91ac4bfc9c38d0bfbda9f68d1831c
commitbcd0039f11a91ac4bfc9c38d0bfbda9f68d1831c[log] [tgz]
authorRoland Shoemaker <roland@golang.org>Wed Apr 14 13:49:18 2021 -0700
committerRoland Shoemaker <bracewell@google.com>Thu Apr 15 15:37:03 2021 +0000
tree0f7bf2a57d02d6221d5301240b0488685c22cb9a
parenta3a17c98162f30663aadeb99acf809b6db539f7d [diff]
all: add script for deploying to GCS bucket

Change-Id: Id11633d0b20c0a45b4d56756ddda0725ae1a73af
Reviewed-on: https://team-review.git.corp.google.com/c/golang/vulndb/+/1055927
Reviewed-by: Roland Shoemaker <bracewell@google.com>
1 file changed
tree: 0f7bf2a57d02d6221d5301240b0488685c22cb9a
  1. client/
  2. cmd/
  3. osv/
  4. report/
  5. reports/
  6. AUTHORS
  7. CONTRIBUTING.md
  8. CONTRIBUTORS
  9. deploy-db.sh
  10. format.md
  11. go.mod
  12. go.sum
  13. LICENSE
  14. new-vuln.sh
  15. PATENTS
  16. README.md
  17. template
  18. triaged-cve-list
README.md

The Go Vulnerability Database golang.org/x/vulndb

This repository is a prototype of the Go Vulnerability Database. Read the Draft Design.

Neither the code, nor the data, nor the existence of this repository is to be considered stable until an approved proposal.

Important: vulnerability entries in this repository are represented in an internal, unstable format that can and will change without notice. The database will also be available in an interoperable, stable JSON format soon.

Packages

Some of these packages can probably be coalesced, but for now are easier to work on in a more segmented fashion.

  • report provides a package for parsing and linting TOML reports
  • osv provides a package for generating OSV-style JSON vulnerability entries from a report.Report
  • client contains a client for accessing HTTP/fs based vulnerability databases, as well as a minimal caching implementation
  • cmd/gendb provides a tool for converting TOML reports into JSON database
  • cmd/genhtml provides a tool for converting TOML reports into a HTML website
  • cmd/linter provides a tool for linting individual reports
  • cmd/report2cve provides a tool for converting TOML reports into JSON CVEs

License

Unless otherwise noted, the Go source files are distributed under the BSD-style license found in the LICENSE file.

The database contents in reports/ are distributed under the terms of the CC-BY 4.0 license.