Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,7 @@ For more details, see our [documentation](https://cve-bin-tool.readthedocs.io/en
- [Generating a VEX](#generating-a-vex)
- [Triaging vulnerabilities](#triaging-vulnerabilities)
- [Using the tool offline](#using-the-tool-offline)
- [No Scan Mode](#no-scan-mode)
- [Using CVE Binary Tool in GitHub Actions](#using-cve-binary-tool-in-github-actions)
- [Output Options](#output-options)
- [Configuration](#configuration)
Expand Down Expand Up @@ -155,6 +156,18 @@ Specifying the `--offline` option when running a scan ensures that cve-bin-tool

Note that you will need to obtain a copy of the vulnerability data before the tool can run in offline mode. [The offline how-to guide contains more information on how to set up your database.](https://github.com/intel/cve-bin-tool/blob/main/doc/how_to_guides/offline.md)

### No-Scan Mode

The No-Scan Mode is currently under development, but you can try out a beta version by running:

```bash
cve-bin-tool <directory> --no-scan
```

In this beta release, all the database-related checks are skipped. For the binary checker pipeline, it gives output based on the CPE information embedded in the checkers. For the language parser pipeline, all database queries are skipped and it returns a bunch of ScanInfo objects.

Please not that you might still find some errors while running no-scan mode in the output pipeline as it is still under development.

### Using CVE Binary Tool in GitHub Actions

If you want to integrate cve-bin-tool as a part of your github action pipeline, you can use cve-bin-tool's official GitHub Action. Find more details [here](https://github.com/intel/cve-bin-tool-action/#cve-binary-tool-github-action). The GitHub Action provide reports on the security tab, which is available to open source projects as well as GitHub customers who have paid for that access.
Expand Down
54 changes: 54 additions & 0 deletions test/test_no_scan.py
Original file line number Diff line number Diff line change
@@ -0,0 +1,54 @@
# Copyright (C) 2025 Intel Corporation
# SPDX-License-Identifier: GPL-3.0-or-later

import subprocess


def test_no_scan_exists():
"""
Test that --no-scan mode exists
"""
result = subprocess.run(
["python3", "cve_bin_tool/cli.py", "--help"],
capture_output=True,
text=True,
encoding="utf-8",
errors="replace",
)

output = result.stdout + result.stderr

assert "no-scan" in output

assert result.returncode == 0


# @pytest.mark.skip(reason="Failing due to unknown errors")
def test_no_scan_output():
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

seems like this particular test is failing.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, Initially I tried cve-bin-tool <directory> --no-scan but that failed
Then I changed the entry point to cve_bin_tool/cli.py but that seems to fail too

Surprising how --no-scan shows up in python3 cve_bin_tool/cli.py --help but not in the above

"""
Test the tool with --no-scan flag
"""
result = subprocess.run(
["python3", "cve_bin_tool/cli.py", "./experiments", "--no-scan"],
capture_output=True,
text=True,
encoding="utf-8",
errors="replace",
)

assert "No-Scan Mode Active" in result.stdout


def test_normal_scan():
"""
Test Normal Scan without --no-scan flag
"""
result = subprocess.run(
["python3", "cve_bin_tool/cli.py", "./experiments"],
capture_output=True,
text=True,
encoding="utf-8",
errors="replace",
)

assert "No Scan Mode: No CVE Scanning" not in result.stdout
Loading