docs consolidation work
This commit is contained in:
@@ -31,7 +31,7 @@ for sbom, vex in zip(SBOMS, VEXES):
|
||||
```
|
||||
|
||||
## Inputs
|
||||
- 3–5 SBOMs (CycloneDX 1.6 / SPDX 3.0.1) + matching VEX docs covering affected/not_affected/fixed.
|
||||
- 3–5 SBOMs (CycloneDX 1.7 / SPDX 3.0.1) + matching VEX docs covering affected/not_affected/fixed.
|
||||
- Feeds bundle: vendor DBs (NVD, GHSA, OVAL) hashed and frozen.
|
||||
- Policy: single normalization profile (e.g., prefer vendor scores, CVSS v3.1).
|
||||
- Reachability dataset (optional combined run): `tests/reachability/samples-public` corpus; graphs produced via `stella graph lift` for each language sample; runtime traces optional.
|
||||
|
||||
Reference in New Issue
Block a user