Making vulnerability scans reproducible with dumpscan

说明与用途

Dumpscan 通过记录所有输入并支持精确重放和差异比较，确保漏洞扫描结果可复现。

问题

Vulnerability scan results can change over time due to updated advisories, scanner logic, or exclusions, making it hard to trace the cause of differences during audits or incident reviews.

结果

Dumpscan ensures that vulnerability scan results are fully reproducible, verifiable, and explainable by recording all inputs and enabling precise diffing of changes.

工作流

• Install dumpscan via npm or npx
• Create an OSV snapshot with dumpscan snapshot
• Run a scan with dumpscan scan --snapshot <path> --out <bundle>
• Optionally sign the bundle with --sign
• Verify the bundle with dumpscan verify
• Replay the scan with dumpscan replay to confirm reproducibility
• Diff two bundles with dumpscan diff to identify changed inputs

证据

dumpscan is an open-source vulnerability scanner that treats each result as a claim that should be possible to reproduce and verify.

来源

The bundle can then be checked without running another scan: dumpscan verify scan.bundle.json

来源