Manage the CVE Database¶

Tasks for keeping CVE scanning fast and reliable when you build meta-tolomeo.

Enable CVE scanning¶

Require the CVE-check include in your distro configuration:

require conf/distro/include/tolomeo-cve-check.inc

This inherits cve-check, so every recipe's do_cve_check runs against the local NVD database.

Use an NVD API key¶

An NVD API key raises the request rate limit and reduces throttling. Provide it through the environment (for example, a masked GitLab CI/CD variable) — it is picked up automatically:

NVDCVE_API_KEY="<your-key>"

Seed a fresh build from a backup¶

A from-scratch NVD download is slow and can fail. To avoid it, point CVE_DB_BACKUP_FILE at a pre-populated database; it is copied into the downloads directory before the fetch when no database is present.

• CI: the default already resolves to the shared cache (${YOCTO_CACHE_DIR}/downloads/CVE_CHECK/nvdcve_2-2.db). Set YOCTO_CACHE_DIR to your runner's cache location.
• Local: set CVE_DB_BACKUP_FILE to a local copy (e.g. downloaded from your CI cache), or leave it unset to accept the one-time full download.

Refresh the shared database on a schedule¶

meta-tolomeo ships a refresh-cve-db CI job that updates the shared database in place. Activate it by creating a GitLab pipeline schedule with:

• Branch: your stable branch (e.g. scarthgap) — required so the job uses the shared cache.
• Cadence: once or twice a day.
• Variable: SCHEDULE_TYPE=cve-db.

Skip the update on feature builds¶

Feature builds seed from the shared database and skip the network update entirely by setting:

variables:
  CVE_DB_UPDATE_INTERVAL: "-1"

meta-tolomeo already sets this on build:devel.

Troubleshooting¶