gcve-enriched-dumps-csaf

This repository contains CSAF 2.1 CSD02 documents generated from GCVE-enriched CVE JSON 5 records.

The conversion is performed by tools/gcve_cve_to_csaf.py, a Python script that:

• Converts GCVE-enriched CVE records into CSAF 2.1 CSD02 JSON documents.
• Scans directories recursively for CVE-*.json inputs.
• Emits one CSAF output document per input record.
• Maps x_gcve content into CSAF x_extensions using a schema URI.
• Maps vulnerability-lookup:meta.epss into native CSAF metrics.
• Optionally preserves full Vulnerability-Lookup metadata as a CSAF note.

Repository layout

• tools/gcve_cve_to_csaf.py – converter script.
• cves/ – generated CSAF JSON documents.

Requirements

• Python 3.10+ (standard library only; no third-party dependencies required).

Usage

python3 tools/gcve_cve_to_csaf.py INPUT OUTPUT [options]

Positional arguments

• INPUT – path to a single CVE JSON file or a directory recursively scanned for CVE-*.json files.
• OUTPUT – output directory for generated CSAF JSON documents.

Options

• --gcve-extension-schema URL
  • Schema URI used for native x_gcve extension instances.
  • Default: https://gcve.eu/schema/csaf/extensions/gcve-bcp-05-x-01_1.0.0.json
• --publisher-name NAME
  • CSAF publisher name (default: GCVE.eu).
• --publisher-namespace URI
  • CSAF publisher namespace URI (default: https://gcve.eu/).
• --publisher-category {coordinator,discoverer,other,translator,user,vendor}
  • CSAF publisher category (default: coordinator).
• --category VALUE
  • CSAF document category (default: csaf_base).
• --source-base-url URL
  • Base URL to link source records from generated documents.
  • Pass an empty string to omit source links.
  • Default: https://github.com/gcve-eu/gcve-enriched-dumps/blob/main/
• --vl-meta {none,summary,full}
  • How to preserve vulnerability-lookup:meta:
    • none: do not keep metadata.
    • summary: map EPSS only (default).
    • full: map EPSS and retain full metadata payload as a note.
• --include-rejected
  • Include non-PUBLISHED records as interim CSAF documents.
• --overwrite
  • Overwrite existing output files.
• --sha256
  • Write .sha256 integrity files next to each generated JSON file.
• --fail-fast
  • Stop on first invalid record or conversion error.
• --quiet
  • Print only final summary and errors.

Examples

Convert a directory of CVE JSON files and generate SHA256 sidecar files:

python3 tools/gcve_cve_to_csaf.py ./gcve-enriched-dumps/cves ./csaf-out --sha256

Convert a single CVE file while preserving full Vulnerability-Lookup metadata:

python3 tools/gcve_cve_to_csaf.py ./CVE-2024-12345.json ./csaf-out --vl-meta full

Convert and overwrite existing outputs:

python3 tools/gcve_cve_to_csaf.py ./input-cves ./csaf-out --overwrite

Notes

• This tool is a format converter, not a full publication pipeline.
• Before publication, providers should still address publisher metadata policy, signing, distribution, extension-schema publication, and formal conformance validation.