Will cve-bin-tool database be built into emba container when cve-database.db file provided in <emba-home>/installer directory?

[jni2000]

Hi Community,

I rebuilt the emba container image and found that

1. my image size is about 2GB smaller than the emba official one
2. every time when I run my local container image, I found that cve-bin-tool --import runs in multiple threads which I did not see when running the official emba container image.

Looks like my image is missing the cve-bin-tool database. I do have a copy of "cve-database.db" file in my [emba-home]/installer directory when rebuilding the emba container image. I also have a copy of "cve-database.db" in my [emba-home]/config when running the emba container image. What did I miss ?

Thanks

James

[m-1-k-3]

on a build it should automatically download and install the cve database. The import is just in case you have some database that you want to use for your image. If it is found in ./installer/cve-database.db it should get imported. Nevertheless, in the latest build I have not used this mechanism anymore and used the automatic populated db

[m-1-k-3]

This import mechanism was for the time where cve-bin-tool has not supported the nvd2 format and removed old cve entries. With this import mechanism we were able to provide an accurate database also with the old CVE entries. The mechanism is not needed anymore as cve-bin-tool now supports the new data format.

[jni2000]

So your answer to my questions about that I am current seeing multiple concurrent "cve_bin_tool/cli.py --import ./config/cve_database.db" is a normal behavior and they are for providing an accurate database also with the old CVE entries? If this is not needed anymore, shall I delete the cve_database.db in ./config ?

[m-1-k-3]

You should not need the database in config anymore. The cve-bin-tool should get updates during the installation procedure. This was just a workaround during the last months as cve-bin-tool was not able to handle the new format. In the future we will remove this code area completely

[jni2000]

After deleting the cve-database.db in my config directory, I am still seeing cve-database import from external directory running in multiple threads and took about 15 - 25 minutes to finish. Is this an expected behavior? I did rebuilt the container image myself with a cve-database.db file in my installer directory. Is this the cause ? Shall I rebuild the image without cve-database.db file in installer directory?

Thanks.

[m-1-k-3]

During building the docker image you setup a fresh database in the external directory of the image. What you can see is the import of this database

[jni2000]

Do you mean that emba needs to import the database on every single run? The picture I attached is a screenshot when running the emba, not at the image build time. Even if this import is required for every emba run, why so many import threads are needed ?

[m-1-k-3]

yes ... EMBA is importing the db on every run.

[jni2000]

yes ... EMBA is importing the db on every run.

I noticed that the import were done in multiple threads, but in codes I did not see where this was multi-threaded. Can you please explain a bit? Thanks again.

[m-1-k-3]

This comes from cve-bin-tools directly