sbomnix
sbomnix copied to clipboard
vulnxscan: Add cve-bin-tool scanner
Adds cve-bin-tool scanner to vulnxscan.
Why do we use cve-bin-tool fork instead of the upstream or the version in nixpkgs? The main reason is, both the upstream and the nixpkgs versions require an older version of python packaging. This project (vulnxscan) also requires packaging, but it needs a newer version. This results a conflict in python dependencies. The cve-bin-tool fork we are using in this PR attempts to resolve the upstream cve-bin-tool python dependencies issues so that newer version of packaging can be used in cve-bin-tool. As soon as the issue is properly resoved upstream and in nixpkgs, we should change vulnxscan to also start using the cve-bin-tool version from nixpkgs.