mrl5 / vulner

Discover CVEs for packages installed by the portage
Mozilla Public License 2.0
7 stars 1 forks source link

support usage of NVD API Key #31

Closed mrl5 closed 2 years ago

mrl5 commented 2 years ago

from: https://nvd.nist.gov/developers

Requesting an API key allows for users to make a greater number of requests in a given time than they could otherwise. The public rate limit (without an API key) is 10 requests in a rolling 60 second window; the rate limit with an API key is 100 requests in a rolling 60 second window.

in order to make sure that vulner scan doesn't hit rate limiting it could support usage of NVD API keys

it can be provided from either env variable (like in wrangler CLI) and/or file (like in aws-cli)

with NVD APIs it's apiKey query string parameter

references https://nvd.nist.gov/general/news/API-Key-Announcement https://nvd.nist.gov/developers https://nvd.nist.gov/developers/request-an-api-key

mrl5 commented 2 years ago

this will be probably needed for large scans like the one that is the subject of #29

mrl5 commented 2 years ago

it's documented here: https://github.com/mrl5/vulner/blob/master/docs/COOKBOOK.md#using-api-keys also visible in CLI here:

$ vulner scan --help | grep NVD_API_KEY
    <nvd-api-key>     [env: NVD_API_KEY=]

section in config:

$ cat ~/.config/vulner/vulner.toml 
[api_keys]
nvd_api_key = ''