Class VulnDbUpdateCommand
- Namespace
- Kuestenlogik.Bowire.Security.Scanner
- Assembly
- Kuestenlogik.Bowire.Security.Scanner.dll
bowire vulndb update — refresh the local template cache
(~/.bowire/vulndb) from the curated Kuestenlogik/Bowire.VulnDb
template set. Split out of the CLI command so it's drivable with a pinned
TextWriter and an injected HttpMessageHandler;
the directory- and tarball-source paths need no network at all, so the core
logic is unit-tested offline.
Trust boundary: a fetched archive is trusted on the basis of TLS to
the source host (github.com for the default release path) plus the
decompression-size cap and path-traversal-safe extraction below. There is
no per-archive signature / checksum verification yet — that needs the
Bowire.VulnDb release pipeline to publish signed checksums first; tracked as
follow-up. Air-gapped installs that need stronger assurance should fetch out
of band and use --source <verified-file-or-dir>.
public static class VulnDbUpdateCommand- Inheritance
-
VulnDbUpdateCommand
- Inherited Members
Methods
RunAsync(VulnDbUpdateOptions, CancellationToken, TextWriter?, TextWriter?, HttpMessageHandler?)
Run the update. Returns a process exit code: 0 = the cache was refreshed, 1 = the source couldn't be resolved / fetched, 2 = a usage error (e.g. a source path that doesn't exist).
public static Task<int> RunAsync(VulnDbUpdateOptions options, CancellationToken ct, TextWriter? output = null, TextWriter? error = null, HttpMessageHandler? httpHandler = null)Parameters
optionsVulnDbUpdateOptionsctCancellationTokenoutputTextWritererrorTextWriterhttpHandlerHttpMessageHandler