Background

• Sometimes, dependencies have CVEs which are a non-issue for our use case, or we have a false positive. In these case, we need to be able to ignore certain CVEs

Acceptance Criteria

• Provide a CLI parameter to define an ignore list
• The ignore list should contain one CVE per line and allow comments starting with #
• The ignore list is used for filtering the CVEs

Background

python -m conda_vulnerability_scanner.scanner fetch --db-directory tmp_test_Db
Failed to open DB. dbtype: sqlite3, dbpath: tmp_test_Db/cpe.sqlite3, err: unable to open database file: no such file or directory
ERROR:root:Caught error: Command '['/tmp/tmpxo3k_tb8/go-cpe-dictionary', 'fetch', 'nvd', '--dbpath', 'tmp_test_Db/cpe.sqlite3']' returned non-zero exit status 1.

Acceptance Criteria

• Using relative paths should work

Background

• We need a design description
• We need a developer guide which explains how to update the use binaries

Acceptance Criteria

• Developer Guide
• Design

Background

• Often, only CVEs with severity high and critical are necessary to investigate

Acceptance Criteria

• Provide a CLI parameter to define filter
• We filter the CVEs by severity groups defined here https://nvd.nist.gov/vuln-metrics/cvss
• We can filter cvss v2 and v3

Background

• We moved the project to a release session in nox, but didn't adapt the Github Workflow

Acceptance Criteria

• Use nox release session for release in Github Workflow

Background

For our conda script-language flavors, we need a vulnerability scanner which can translate from conda package names to cpe and lookup cves for cpes.

Acceptance Criteria

• Fetching the necessary resources for cpe and cve lookup
• Scan resources for conda packages

Background

• with poetry 1.4.0 it doesn't create the setup.py anymore https://github.com/python-poetry/poetry/releases/tag/1.4.0
• we currently use poetry build to generate the setup.py
• however, the setup.py isn't needed with newer pip versions and if there are releases to pypi or as wheels
• for that reason, we can remove setup.py and githook that generates it, from this repo

Acceptance Criteria

• Update workflows to poetry 1.4.0
• Remove setup.py Github Workflow
• Remove setup.py githook
• Remove setup.py file