Milestone: cvelistV5 (CVE JSON 5.x) consumer into the vuln KB #2

New issue

Open

opened 2026-09-24 23:34:47 +00:00 by lost-rob0t · 0 comments

lost-rob0t commented

2026-09-24 23:34:47 +00:00

(Migrated from github.com)

Source: https://github.com/lost-rob0t/zero-forge/blob/master/docs/architecture.md (discovery subgraph, advisory-source policy) plus operator directive (2026-09-24)
Upstream corpus: https://github.com/CVEProject/cvelistV5 (CVE JSON 5.x records)
Lineage: port-mapping milestone derived from ZeroForge

Scope

Implement a consumer that ingests the CVEProject/cvelistV5 corpus into the
vulnerability KB:

Parse CVE JSON 5.x records (containers: cna/adp, affected, descriptions,
references, metrics, credits) into vuln/… facts with provenance.
Corpus acquisition: git clone/pull of cvelistV5 or ranged reads of release
archives; bounded batch ingest with a resumable cursor.
Idempotent re-ingest by CVE ID + digest; changed records supersede with
revision history retained.
Map deny/reject/rejected records to explicit status terms, never dropped
silently.

Acceptance criteria

Ingest of a sampled slice of the corpus completes with counts and failures
reported; exit code fails non-zero on any unhandled parse error.
Re-ingest of an unchanged corpus performs zero KB mutations (test covered).
A CVE JSON 5.x malformed record lands in quarantine with reason, not a crash.
Memory/runtime bounded: streaming per-file parse, no full-corpus slurp.

Dependencies

Vulnerability KB subsystem milestone (facts it writes into).

Non-goals

No enrichment calls (OSV/GHSA/KEV) — separate evidence milestone.
No ranking/scoring policy decisions beyond preserving CVSS metrics as facts.

Implementation approval is not inferred from this issue.

**Source**: https://github.com/lost-rob0t/zero-forge/blob/master/docs/architecture.md (discovery subgraph, advisory-source policy) plus operator directive (2026-09-24) **Upstream corpus**: https://github.com/CVEProject/cvelistV5 (CVE JSON 5.x records) **Lineage**: port-mapping milestone derived from ZeroForge ## Scope Implement a consumer that ingests the CVEProject/cvelistV5 corpus into the vulnerability KB: - Parse CVE JSON 5.x records (containers: cna/adp, affected, descriptions, references, metrics, credits) into `vuln/…` facts with provenance. - Corpus acquisition: git clone/pull of cvelistV5 or ranged reads of release archives; bounded batch ingest with a resumable cursor. - Idempotent re-ingest by CVE ID + digest; changed records supersede with revision history retained. - Map deny/reject/rejected records to explicit status terms, never dropped silently. ## Acceptance criteria - Ingest of a sampled slice of the corpus completes with counts and failures reported; exit code fails non-zero on any unhandled parse error. - Re-ingest of an unchanged corpus performs zero KB mutations (test covered). - A CVE JSON 5.x malformed record lands in quarantine with reason, not a crash. - Memory/runtime bounded: streaming per-file parse, no full-corpus slurp. ## Dependencies - Vulnerability KB subsystem milestone (facts it writes into). ## Non-goals - No enrichment calls (OSV/GHSA/KEV) — separate evidence milestone. - No ranking/scoring policy decisions beyond preserving CVSS metrics as facts. Implementation approval is not inferred from this issue.