Description
I put this originally in #267 but it occurs to me that it's worth filing as a separate issue so it can be discussed outside of GSoC's context:
- Generate full reports with CVE descriptions, etc. We don't currently store these in the database and probably don't want to for speed/space reasons, so you'd have to grab from the json. This was a feature that used to exist in cve-bin-tool before it was open sourced. The idea, I believe, is that you'd have something you could easily attach to an email or send in a meeting agenda so decisions could be made prioritizing fixes. In practice it wasn't getting used much which is why it wound up dropped before release, but it could still be useful for folk who need more info to send to their colleagues.
As I said in #324 (Adding a GUI), all signs I've had from our known users point to them wanting as little GUI as possible -- things are running on the command line, probably in CI systems like Github Actions or Travis. So we get requests for machine readable output, or we get requests for no output at all, only a pass-fail so a known cve will "break the build" as it were and alert people that something's wrong.
But I don't think that necessarily means people don't want good human readable output, just that it's probably not going to be desired in a "single user at a computer running a report for themselves" context. It's more likely "the build system will do the checks on its own time" and "maybe when the build fails we'll want to generate a report that can be emailed to the guilty parties" or "maybe when we investigate we'll need some nice reports to take to management so they can assign people to fix issues with appropriate priorities." I'm... honestly not sure what people are going to want here, but juding from what I see in similar tools, here's some ideas:
- What files are affected
- What packages/versions were found
- What CVEs were found
- Some sort of colourized output to show you which CVEs are most scary by severity rating
- Maybe show more of the severity data? (We're using only the summary number but there's more there)
- Maybe a longer report with the short CVE description text
- Make the whole thing possible to generate from one of those machine readable logs (see Machine-readable output #262) so it could be done after the fact only as needed and you wouldn't have to re-run scans
- Maybe some graphs ?
- Maybe some ability to track changes vs a previous log if one's available? (probably needs to go with machine readable logs Machine-readable output #262 )
I'm guessing they'll want this in a format that can easily be emailed around, so probably html is the easiest if we're going past the plain-text output we have now (+svg for graphs?). But I'm not tied to that idea.