[Feature]: Option to pass down your own advisory.json file

[nutangwari]

Problem

Currently to Corporate SSL proxy blocks the download of Advisory DB, although there is way to resolve it, but in some cases it's directly blocked to connect outside of our air-gap environment. Can we have a provision to pass down the our own custom Advisory json file? Instead of cli pulling it.

Proposed idea

User can provide their own Advisory JSON file.

CLI Exposing schema json file to make sure provided json is as per the standard CLI tool need.
User can provide file path for the advisory JSON file. It's user responsibility to keep this file updated.

Describe the feature or improvement.

Why it fits this project

Explain why this aligns with CVE Lite CLI's goals:

• practical developer usability
• Running scan of your app against older CVEs, Older versions of application shouldn't be flagged for the new CVE.

CLI:
cve-lite --advisory-json /path/to/advisory.json

[sonukapoor]

Thanks for the detailed write-up, Nutan - air-gapped environments are a real use case worth supporting properly.

Quick note on what already exists: if you have access to an internet-connected machine, you can run cve-lite advisories sync --output advisories.db there, copy the SQLite file over, and use --offline-db /path/to/advisories.db in the air-gapped environment. That covers the "no outbound connection" case if a file transfer is possible.

For your scenario where that is not possible at all, or where you want to use your own internal vulnerability data, here is what I am thinking: a new cve-lite advisories init command that creates an empty SQLite DB with the correct schema and no data. You would then populate it from your own sources using any SQLite client or script, and pass it to --offline-db as normal. No new file format, no import pipeline - just the schema handed to you so you can fill it yourself.

Does that cover your use case? If so I will open a tracking issue for advisories init. The "only flag CVEs up to a certain date" angle from your issue is a separate question - is that also a hard requirement for you, or was that a secondary concern?