Making vulnerability scans reproducible with dumpscan

Описание и применение

Dumpscan обеспечивает воспроизводимость результатов сканирования уязвимостей, фиксируя все входные данные и позволяя точно воспроизводить и сравнивать результаты.

Задача

Vulnerability scan results can change over time due to updated advisories, scanner logic, or exclusions, making it hard to trace the cause of differences during audits or incident reviews.

Результат

Dumpscan ensures that vulnerability scan results are fully reproducible, verifiable, and explainable by recording all inputs and enabling precise diffing of changes.

Рабочий процесс

• Install dumpscan via npm or npx
• Create an OSV snapshot with dumpscan snapshot
• Run a scan with dumpscan scan --snapshot <path> --out <bundle>
• Optionally sign the bundle with --sign
• Verify the bundle with dumpscan verify
• Replay the scan with dumpscan replay to confirm reproducibility
• Diff two bundles with dumpscan diff to identify changed inputs

Доказательства

dumpscan is an open-source vulnerability scanner that treats each result as a claim that should be possible to reproduce and verify.

Источник

The bundle can then be checked without running another scan: dumpscan verify scan.bundle.json

Источник