Data dumps

Signed builds of the published data, to seed a local instance or an air-gapped relay.

Builds are not signed on this instance.

CLI cache

Partial cache: Maven CVE and OSV indexes, NVD mirror, CISA KEV, EPSS, EUVD and CERT-FR. Other ecosystems and registry data are not included; prepare those separately for offline scans.

This CLI archive is delivered over HTTPS and has no separate signature.

Download the CLI cache

vigievuln cache import vigievuln-cli-cache.tar.gz

Project offline cache

Create a descriptor with the CLI, review it, then upload it with your proxy key. Dependency names and versions are sent to the server. The descriptor is deleted after preparation and the private cache expires 20 minutes later. Maximum descriptor size: 0.5 MB.

vigievuln scan ./project --export-anonymized deps.json
curl -H "Authorization: Bearer $VIGIEVULN_PROXY_CACHE_TOKEN" -H "Content-Type: application/json" --data-binary @deps.json https://api.vigievuln.fr/v1/offline-exports
curl -H "Authorization: Bearer $VIGIEVULN_PROXY_CACHE_TOKEN" https://api.vigievuln.fr/v1/offline-exports/EXPORT_ID
curl -H "Authorization: Bearer $VIGIEVULN_PROXY_CACHE_TOKEN" -o vigievuln-project-cache.tar.gz https://api.vigievuln.fr/v1/offline-exports/EXPORT_ID/download
vigievuln cache import vigievuln-project-cache.tar.gz

Replace EXPORT_ID with the returned identifier and wait for ready status. staleSources lists sources for which older cached data was used.

Use a build

vigievuln-server verify fad-public-….manifest.json --trust-key signing-key.pem
vigievuln-server restore fad-public-….manifest.json --trust-key signing-key.pem
vigievuln serve-cache --seed fad-private-….manifest.json --trust-key signing-key.pem