Manage the CVE Database¶

Tasks for keeping CVE scanning fast and reliable when you build meta-tolomeo.

Enable CVE Scanning¶

Require the CVE-check include in your distro configuration:

require conf/distro/include/tolomeo-cve-check.inc

This inherits cve-check, so every recipe's do_cve_check runs against the local NVD database.

Use an NVD API Key¶

An NVD API key raises the request rate limit and reduces throttling. Provide it through the environment (for example, a masked GitLab CI/CD variable) — it is picked up automatically:

NVDCVE_API_KEY="<your-key>"

Seed a Fresh Build From a Backup¶

A from-scratch NVD download is slow and can fail. To avoid it, CVE_DB_BACKUP_URL points at a pre-populated database that is downloaded into the downloads directory before the fetch, but only when no database is present yet. The default points at the shared cache mirror; the server's Last-Modified time is preserved so the stock recipe can still do a small incremental top-up.

Point CVE_DB_BACKUP_URL at your own mirror to seed from it, or leave it unset to accept the one-time full NVD download.

Refresh the Shared Database on a Schedule¶

meta-tolomeo ships a refresh-cve-db CI job that updates the shared database in place. Activate it by creating a GitLab pipeline schedule with:

• Branch: your stable branch (e.g. scarthgap) — required so the job uses the shared cache.
• Cadence: once or twice a day.
• Variable: SCHEDULE_TYPE=cve-db.

Skip the Update on Feature Builds¶

Feature builds seed from the shared database and skip the network update entirely by setting:

variables:
  CVE_DB_UPDATE_INTERVAL: "-1"

meta-tolomeo already sets this on build:devel.

Troubleshooting¶