Vulnerabilities, VEX and exploitation context

Manage the local, pinned vulnerability-data snapshots a run can match against:
download one (`update`, the one explicit network step), then inspect, verify,
pin, reindex, retain and compare them offline. --dir is set here, before the
verb. Name a verb, or the group prints its usage and exits 2.

sbomflow vulndb --dir vuln-data sources

sbomflow vulndb --dir vulndb-store verify

sbomflow vulndb --dir vulndb-store inspect

Explain what changed between two RECORDED source sets (from `vulndb
sources --set`, or the set a run recorded), reading each side's retained
snapshots, and which stored release candidates that may affect. The
active set is never substituted for a recorded one. Read-only and
offline; it writes source-change-impact.json, or prints it with --json
(and also writes it into an --output named beside it).

sbomflow vulndb --dir vulndb-store change-impact --old-set vulndb-sets/set-old.json --new-set vulndb-sets/set-new.json --store .sbomflow-store

sbomflow vulndb --dir vulndb-store change-impact --old-set vulndb-sets/set-old.json --new-set vulndb-sets/set-new.json --store .sbomflow-store --json --as-of 2026-07-01T00:00:00Z

List the snapshots in a local snapshot directory with their manifests, as
JSON. Read-only; an empty directory lists none.

sbomflow vulndb --dir vulndb-store inspect

sbomflow vulndb --dir vuln-data inspect

Make one snapshot the active one its source matches against, recording the
change in the activation log. Offline; an id the directory does not hold exits
2.

sbomflow vulndb --dir vulndb-store pin c3a055262999702f

sbomflow vulndb --dir vulndb-store pin no-such-snapshot

Rebuild the derived index.json of a local snapshot directory from its snapshot
manifests, after the index was lost or corrupted. Offline.

sbomflow vulndb --dir vulndb-store reindex

Plan conservative snapshot retention: a snapshot any release in the evidence
store still references is kept. --apply removes the rest; without it nothing
is deleted.

sbomflow vulndb --dir vulndb-store retention --release-store .sbomflow-store

sbomflow vulndb --dir vulndb-store retention --release-store .sbomflow-store --apply

List the registered vulnerability sources and the snapshot each one has ACTIVE
locally, or one source in full. --set prints the content-addressed active set
to record beside a run; --verify-set replays a recorded set and exits 1 when a
source no longer matches; --coverage says which sources an operator can reach
from this build. Nothing is activated or fetched.

sbomflow vulndb --dir vuln-data sources

sbomflow vulndb --dir vulndb-store sources --json

sbomflow vulndb --dir vulndb-store sources --set

sbomflow vulndb --dir vulndb-store sources --verify-set vulndb-sets/set-old.json

Download one official data archive (an OSV dump, a CVE List V5 release, an NVD
feed, or a managed KEV or EPSS feed) into a pinned, content-hashed snapshot
with its manifest. This is the one explicit network step in SBOMFlow; every
other vulndb verb is offline. Exactly one of --url or --source names what to
fetch; --source csaf-provider --url walks a CSAF 2.0 provider's TLP:WHITE
feeds into a local mirror. --source-type csaf-directory --path <dir> instead
registers a local directory of CSAF 2.0 advisories and opens no socket.

sbomflow vulndb --dir vuln-data update

sbomflow vulndb --dir vuln-data update --source kev --url https://example.invalid/kev.json

Re-hash every snapshot, or one, and re-count its records against its manifest.
A snapshot that is missing or does not match exits 1. Offline.

sbomflow vulndb --dir vulndb-store verify

sbomflow vulndb --dir vulndb-store verify c3a055262999702f --json

sbomflow vulndb --dir vulndb-store verify no-such-snapshot

Answer the continuous vulnerability-handling question: has anything in this
already-shipped, FROZEN release become newly affected since we shipped it?
The release's components are read from its evidence-pack.json (the source
is never re-scanned) and the shipped pack is never mutated. Supply the newer
advisory data as a local snapshot.

  Statuses  newly_affected / no_longer_affected / unchanged. A prior
            reviewer decision is attached as CONTEXT only, never applied.
  Snapshot  with --vulndb-dir, each row says whether its advisory was in
            the snapshot the release recorded, looked up by that digest
            only; without it every row reads release_snapshot_unavailable.

sbomflow recheck out --osv-snapshot osv-snapshot.json

sbomflow recheck out --osv-snapshot osv-snapshot.json --store .sbomflow-store --kev-file kev.json --as-of 2026-07-01T00:00:00Z

sbomflow recheck out --osv-snapshot osv-snapshot.json --vulndb-dir vulndb-store

Read one Trivy JSON report and write each result as a sourced external
observation, on stdout or to --output. Offline. An imported result is a claim
about what Trivy said, never a native finding, a VEX status or a gate input.

sbomflow ingest-trivy exports/trivy.json

sbomflow ingest-trivy exports/trivy.json --output trivy-ingest.json

sbomflow ingest-trivy exports/grype.json

Read one Grype JSON report and write each match as a sourced external
observation, on stdout or to --output. Offline. An imported match is a claim
about what Grype said, never a native finding, a VEX status or a gate input.

sbomflow ingest-grype exports/grype.json

sbomflow ingest-grype exports/grype.json --output grype-ingest.json

Read one SARIF 2.1.0 log from a static-analysis tool (CodeQL, Semgrep, clang-
tidy and others) and write each result as a sourced external observation, on
stdout or to --output. Offline. An imported result is a claim about what that
tool said, never a native finding, a VEX status or a gate input.

sbomflow ingest-sarif exports/semgrep.sarif

sbomflow ingest-sarif exports/semgrep.sarif --output sarif-ingest.json

Import a completed Codex Security scan directory an operator placed on
disk as external AI-assisted observations. Offline: it never runs or
authenticates to the scanner. Every imported result is needs_review, never
a gate input, a VEX status or an approval; coverage stays visible, and zero
findings never means safe.

sbomflow ingest-codex-security codex-scan

sbomflow ingest-codex-security codex-scan --output codex-security-ingest.json --as-of 2026-07-01T00:00:00Z

sbomflow ingest-codex-security codex-scan --release-revision abc123 --release-id example-gateway-2.4.1 --json

Import a CVE report a build tool wrote about its own packages - Yocto's
cve-check or vex class JSON (also sbom-cve-check's yocto-cve-check-manifest
export), or Buildroot's pkg-stats --json - as external observations. Each
row is the build tool's claim, its status and detail recorded verbatim;
none is an SBOMFlow finding, a VEX status, a review decision or a gate
input. When OUTPUT_DIR holds an evidence pack, each claim is shown beside
SBOMFlow's finding for the same component and CVE, whose status is unchanged.

sbomflow ingest-build-cve-report cve-summary.json --format yocto-cve-json --producer-release 'scarthgap 5.0.4' --output out

sbomflow ingest-build-cve-report pkg-stats.json --format buildroot-pkg-stats --producer-release 2024.02.6 --output br-claims

sbomflow ingest-build-cve-report pkg-stats.json --format yocto-cve-json --producer-release 2024.02.6 --output wrong

Validate the packaged CISA SSVC coordinator decision model, or a supplied one,
against its schema and decision-table rules. The exit code is the contract: a
missing or invalid model exits 4.

sbomflow validate-ssvc-model

sbomflow validate-ssvc-model exports/trivy.json

Import the vulnerabilities[] of a CycloneDX VDR or VEX that a binary-analysis
or SCA tool exported about this release, as external observations: one row
per vulnerability and affects[].ref, the ref resolved to the document's own
component (an unresolved ref is kept and counted), ratings verbatim. The
tool's analysis state and justification are recorded as its claim
(decided_by external_tool); none is an SBOMFlow finding, a VEX status, a
review decision or a gate input. When OUTPUT_DIR holds an evidence pack, each
claim is shown beside SBOMFlow's finding for the same component and
vulnerability, whose status is unchanged.

sbomflow ingest-cyclonedx-vdr vdr.json --tool-name synthetic-binary-analyzer --tool-version 0.0.0-synthetic --output out

sbomflow ingest-cyclonedx-vdr sca-vex.json --tool-name synthetic-sca-exporter --tool-version 0.0.0-synthetic --output sca-claims

sbomflow ingest-cyclonedx-vdr pkg-stats.json --tool-name synthetic-sca-exporter --tool-version 0.0.0-synthetic --output wrong