# Bundled CVE affected-files index

The Security view can link a CVE's **affected source files** (from a CVE 5.x
record's `affected[].programFiles` / `programRoutines` / `modules`) to the `File`
elements in the loaded SBOM. It learns those files two ways:

- **Live** – fetches each CVE record from `cveawg.mitre.org` on demand when you
  open a vulnerability. Always current, but one request per CVE (so bulk linking
  the whole SBOM is bounded, and it needs network + cve.org to be reachable).
- **Bundled index** – a pre-built, statically-hosted snapshot mapping CVE id →
  affected files/functions/modules. One fetch links every CVE in the SBOM at
  once, offline, with no per-CVE request. This document covers building it.

Both feed the same matcher, so they produce the same links; the bundle only
changes _delivery_ (one fetch, offline, no cve.org rate limit).

## What the artifact is

`scripts/build-cve-affected-index.mjs` scans a CVE 5.x corpus, distills each
record that names affected files (via the shipped `summarizeCveRecord`, so the
bundle matches what the UI renders), and writes:

- `index.json` – `{ schema, source, notice, generated, count, cves }`, where
  `cves` maps `"CVE-2024-26581"` → `{ f: [files], r: [routines], m: [modules] }`.
  Only CVEs that actually declare affected data are included.
- `meta.json` – the same header **minus** `cves`, for a cheap freshness peek.

The affected-files data is sparse and concentrated (it comes almost entirely
from a few CNAs, the Linux kernel above all), so the whole index is small enough
to ship as one file the client fetches once and looks up by CVE id — no manifest
or Range requests needed, unlike the larger NVD CPE index.

## Building it

```bash
git clone --depth 1 https://github.com/CVEProject/cvelistV5
node --max-old-space-size=8192 scripts/build-cve-affected-index.mjs \
  --dir cvelistV5/cves --out cve-affected
```

To gauge size/coverage before building, run
`node scripts/measure-cve-affected-index.mjs --dir cvelistV5/cves`.

The **Build CVE affected-files index** GitHub workflow
(`.github/workflows/build-cve-affected-index.yml`) does this weekly (and on
demand) and publishes `index.json` + `meta.json` as assets on a rolling
`cve-affected-index` pre-release.

## Hosting it

The app's affected-files bundle has a configurable base URL (default
`./cve-affected/`). The Pages deploy (`.github/workflows/pages.yml`) copies the
release assets into `/cve-affected/` so the default works same-origin (no CORS).
Point the base URL elsewhere to serve it from the release or another host.

## Attribution

CVE records are published by the [CVE Program](https://www.cve.org) under CC0.
CVE is a registered trademark of MITRE. The generated `index.json` carries this
notice in its `notice` field; keep the attribution when redistributing.
