cve-source-check

# CVE Source Check Audit CVE/vulnerability source coverage for a technology stack. Maps components to authoritative CVE feeds via a versioned registry, flags gaps, and produces audit-ready reports (JSON + Markdown). **In scope**: component-to-feed mapping, coverage/gap reporting, optional URL reachability checks. **Out of scope**: running scanners (Trivy/Snyk), fetching CVE content, private vuln databases. ## Quick Start ```bash # Inline, offline python3 scripts/check-cve-sources.py \ --inline "go@1.22,alpine@3.19,postgres@16,redis@7,nginx@1.25" \ --service my-service # Inventory + monitored feeds + link verification python3 scripts/check-cve-sources.py \ --inventory examples/inventory.example.json \ --current-sources examples/current-sources.example.txt \ --service my-service --check-urls ``` ## Inputs | Flag | Purpose | |---|---| | `--inventory <file>` | JSON: `[{name, version?, type?}, ...]` or `{components: [...]}`. | | `--inline "name@ver,..."` | Comma-separated list. Mutually exclusive with `--inventory`. | | `--current-sources <file>` | One URL per line. `#` comments and blank lines skipped. | | `--service <name>` | Name for report header and filenames. | | `--check-urls` | HEAD-check every source URL (5s timeout, graceful degradation). | | `--registry <path>` | Override default `tech-source-registry.json`. | | `--out-dir <path>` | Output directory (default: cwd). | JSON only. YAML not supported (no stdlib parser). ## Outputs Files: `cve-source-repo...