From 3acf2f71d49328aa67c5717589de409e814f26d8 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Wed, 19 Nov 2025 22:34:17 +0100 Subject: [PATCH] support/scripts/cve.py: don't call download_nvd This patch move the 'download_nvd' call to the 'pkg-stats' script instead of automatically calling 'read_nvd_dir'. Since the cve.py file can be used as a library it's up to the caller to decide whether or not to update the NVD database. Signed-off-by: Thomas Perale Signed-off-by: Peter Korsgaard (cherry picked from commit 867017e736ac53857685d424f043d16c97ffebfe) Signed-off-by: Thomas Perale --- support/scripts/cve.py | 6 ++++-- support/scripts/pkg-stats | 2 ++ 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/support/scripts/cve.py b/support/scripts/cve.py index 25481a6367..27a5f2f362 100755 --- a/support/scripts/cve.py +++ b/support/scripts/cve.py @@ -144,7 +144,9 @@ class CVE: self.nvd_cve = nvd_cve @staticmethod - def download_nvd(nvd_git_dir): + def download_nvd(nvd_dir): + nvd_git_dir = os.path.join(nvd_dir, "git") + if os.path.exists(nvd_git_dir): subprocess.check_call( ["git", "pull"], @@ -177,7 +179,7 @@ class CVE: nvd_dir, a fresh copy will be downloaded, and kept in .json.gz """ nvd_git_dir = os.path.join(nvd_dir, "git") - CVE.download_nvd(nvd_git_dir) + for year in range(NVD_START_YEAR, datetime.datetime.now().year + 1): for dirpath, _, filenames in os.walk(os.path.join(nvd_git_dir, f"CVE-{year}")): for filename in filenames: diff --git a/support/scripts/pkg-stats b/support/scripts/pkg-stats index ec46d373d5..cfea179458 100755 --- a/support/scripts/pkg-stats +++ b/support/scripts/pkg-stats @@ -676,6 +676,8 @@ def check_package_cves(nvd_path, packages): cpe_product_pkgs[pkg.name].append(pkg) print(f"Updating NVD database in '{nvd_path}'") + cvecheck.CVE.download_nvd(nvd_path) + for cve in cvecheck.CVE.read_nvd_dir(nvd_path): check_package_cve_affects(cve, cpe_product_pkgs)