CVE Database Reference¶

Technical reference for the NVD CVE database used by cve-check.

Database location¶

Path	Description
`${DL_DIR}/CVE_CHECK/nvdcve_2-2.db`	Local NVD database, downloaded by `cve-update-nvd2-native` and queried by every `do_cve_check`.

Variables¶

Defined in meta-tolomeo-distro/kas/common.yml and exposed as kas env passthroughs, so each can be overridden from the environment (e.g. a GitLab CI/CD variable) without editing kas files.

Variable	Default	Description
`NVDCVE_API_KEY`	`""`	NVD API key. Raises the request rate limit (2s vs 6s between requests).
`CVE_DB_UPDATE_INTERVAL`	`86400`	Update cadence in seconds. `0` forces an update, a negative value skips it.
`CVE_DB_INCR_UPDATE_AGE_THRES`	`10368000`	Age in seconds (120 days) beyond which a full re-download replaces an incremental update.
`CVE_DB_BACKUP_FILE`	`${YOCTO_CACHE_DIR}/downloads/CVE_CHECK/nvdcve_2-2.db`	Pre-populated database copied into `DL_DIR` when no database is present.

Enablement¶

Include	Effect
`conf/distro/include/tolomeo-cve-check.inc`	`INHERIT += "cve-check"` plus kernel CVE enrichment classes. Require it from your distro configuration.

CI refresh job¶

Defined in .gitlab-ci.yml.

Item	Value	Purpose
Job	`refresh-cve-db:tolomeo-qemux86-64`	Runs `bitbake -c fetch cve-update-nvd2-native` against the shared cache with `CVE_DB_UPDATE_INTERVAL=0`.
Policy	`.cve-db-policy`	Runs only when `CI_PIPELINE_SOURCE == "schedule"` and `SCHEDULE_TYPE == "cve-db"`.
Schedule variable	`SCHEDULE_TYPE=cve-db`	Set on a GitLab pipeline schedule (stable branch) to trigger the refresh.