CVE tooling

June 8, 2026 · View on GitHub

title: CVE tooling status: stable kind: feature mode: infra source: > README.md § Skill families (security) and AGENTS.md § Linking CVEs. Implemented in tools/cve-tool-vulnogram/generate-cve-json/, tools/cve-org/, and the security-cve-allocate skill. acceptance:

  • A deterministic command produces a paste-ready CVE 5.x JSON record from a tracking issue's template fields.
  • Tracker-repo URLs and the CVE-tool OAuth URL are filtered out of the record's references before serialisation.
  • The skill regenerates the attached JSON so it stays in lock-step with the issue body.

CVE tooling

What it does

Turns a tracking issue into a CVE allocation and a paste-ready CVE 5.x JSON record — the machine half of the security lifecycle's allocation step. Deterministic (no model calls) so the output is reproducible and reviewable.

Where it lives

  • tools/cve-tool-vulnogram/generate-cve-json/ — a uv run script that parses an issue's template fields (multiple credits, multiple reference URLs, >= X, < Y version ranges) and emits containers.cna JSON matching Vulnogram's export shape, plus the Vulnogram #json paste URL.
  • tools/cve-tool-vulnogram/oauth-api/ — a uv project exposing three console scripts (vulnogram-api-setup, vulnogram-api-record-update, vulnogram-api-check) that POST CVE 5.x JSON to the Vulnogram HTTP API via an ASF-OAuth session cookie, replacing the copy-paste-into-#source flow. The skill detects session expiry via vulnogram-api-check and falls back to the manual paste path when the session is not configured or expired.
  • tools/cve-org/ — CVE.org / CVE-services helpers.
  • Skill: security-cve-allocate — walks the (PMC-gated) allocation form, then updates the tracker and regenerates the attached JSON via generate-cve-json --attach.

Behaviour & contract

  • Deterministic and reviewable. The JSON is generated by a Python script, not an LLM; the same issue yields the same record.
  • Reference hygiene. The project's CVE-tool URL (cveprocess.apache.org/...) and any tracker-repo URLs are filtered out of references[] before serialising — they are OAuth-gated / private.
  • Allocation is PMC-gated. The skill submits nothing itself when the user is not on the PMC; it reshapes the recipe into a relay message.
  • Lock-step. The attached JSON is regenerated whenever the tracker body changes, so the two never drift.

Out of scope

  • Deciding whether a report warrants a CVE (that is triage/assessment).
  • Publishing the CVE (a PMC action outside the framework).

Acceptance criteria

  1. generate-cve-json emits valid CVE 5.x JSON from a tracking issue.
  2. Tracker + CVE-tool URLs are absent from references[].
  3. --attach refreshes the JSON on the tracking issue.

Validation

uv run --project tools/cve-tool-vulnogram/generate-cve-json --group dev pytest
uv run --project tools/cve-tool-vulnogram/oauth-api --group dev pytest

Known gaps

  • stable; drift appears if the CVE 5.x schema or Vulnogram export shape changes upstream — caught by the tool's own tests.
  • The oauth-api's session-cookie approach is a workaround for the ASF Vulnogram instance's lack of a Bearer-token API; if ASF Infra adds a proper API token surface, the tool will migrate to it.