README
¶
CVE service
The CVE service collects the set of Ubuntu kernel CVEs (and related Livepatch Security Notices) and serves them to clients over a small HTTP API. It fetches vulnerability data from an OSV source, keeps it in memory, and refreshes it on a schedule.
The service is a single Go binary with three subcommands:
serveruns the HTTP server and periodically refreshes the catalog.fetchdownloads a data set once and writes it to a file, for air-gapped use.versionprints build information.
Documentation
Full documentation lives in the docs/ folder and follows the
Diátaxis framework:
- Tutorial: serve CVE data locally
- How-to guides for Docker Compose, the rock, air-gapped data pushes, fetching data to a file, and tracing
- Reference for the CLI, HTTP API, data formats, and configuration
- Explanation of the architecture and the CVE and LSN data model
Quick start
Build the binary and serve CVE data on port 8080:
make cves
./cves serve
The server exposes the catalog at /v1/catalog, the LSN catalog at
/v1/lsn-catalog, Prometheus metrics at /metrics, and debug endpoints under
/debug. See the HTTP API reference for details.
You can exercise every endpoint with the cve-service.http
file using an HTTP client such as the VS Code REST Client or JetBrains HTTP
Client.
Run with Docker
Bring up the service and a data volume with Docker Compose:
docker compose up --build
This maps the service to port 8080 on the host. See the Docker Compose guide for the full workflow.
Build the rock
The project ships a 12-factor Go-framework
rock
in rocks/12-factor/. See
Build and run the rock.
Requirements
- Go 1.26 or later
- Optional: Docker,
rockcraft, andsnapcraftfor the packaging workflows
Contributing
Contributions are welcome. Please read CONTRIBUTING.md for the development workflow, coding standards, and the contributor licence agreement requirement, and follow our code of conduct.
Security
To report a security issue, follow the process in SECURITY.md. Please do not open a public issue for security vulnerabilities.
License
The CVE service is free software, distributed under the terms of the GNU Affero General Public License version 3 (AGPLv3). See LICENSE for the full text.
Copyright Canonical Ltd.
Directories
¶
| Path | Synopsis |
|---|---|
|
cmd
|
|
|
cves
command
Package cves implements a CLI tool used to fetch Ubuntu kernels fixed CVEs data and serve them over a simple HTTP API.
|
Package cves implements a CLI tool used to fetch Ubuntu kernels fixed CVEs data and serve them over a simple HTTP API. |
|
internal
|
|
|
otelresource
Package otelresource provides a shared OpenTelemetry resource builder used by the CVE service's tracing and metrics signals.
|
Package otelresource provides a shared OpenTelemetry resource builder used by the CVE service's tracing and metrics signals. |
|
tracing
Package tracing implements HTTP middleware and helpers for distributed tracing using OpenTelemetry with W3C traceparent as the primary propagation format.
|
Package tracing implements HTTP middleware and helpers for distributed tracing using OpenTelemetry with W3C traceparent as the primary propagation format. |
|
version
Package version is used to hardcode the source code version information at build time.
|
Package version is used to hardcode the source code version information at build time. |
|
tools
|
|
|
cvecatalog
Package cvecatalog implements a catalog of contain Ubuntu kernels fixed CVEs which provides quick lookup for arbitrary Ubuntu kernel packages.
|
Package cvecatalog implements a catalog of contain Ubuntu kernels fixed CVEs which provides quick lookup for arbitrary Ubuntu kernel packages. |