Packages & vulnerabilities

Delta enumerates installed packages (a lightweight SBOM), captures them into a baseline for drift detection, and matches them against a local CVE advisory feed.

delta --packages                                       # list packages
delta --root /mnt/image --packages --baseline sbom.json # SBOM of an image
delta --root /mnt/image --cve-feed advisories.json --json # vuln scan

Package collection

Parsed from the text package databases under the active root (so it works offline via --root):

Manager	Database	Notes
dpkg (Debian/Ubuntu)	/var/lib/dpkg/status	only Status ending in installed
opkg (OpenWrt)	/usr/lib/opkg/status, /var/lib/opkg/status	same format as dpkg
apk (Alpine)	/lib/apk/db/installed	P:/V:/A: records

Delta does not read the rpm database. That database is a binary store (BerkeleyDB or sqlite) and needs librpm. Delta has no third-party runtime dependency.

SBOM drift

--packages --baseline records other_packages_present: false plus packages: [{name, version}]. Checking reports high for a missing / version-changed package and medium for an unexpected one. See Baseline capture, Configuration.

CVE feed

--cve-feed <file> matches the inventory against a local JSON advisory feed that you supply (generate it from NVD/OSV with your own tooling — Delta does the matching, including Debian-style version comparison, and stays offline).

{
  "advisories": [
    { "cve": "CVE-2022-0778", "package": "openssl", "severity": "critical",
      "affected": { "lt": "1.1.1n" } },
    { "cve": "CVE-2021-28831", "package": "busybox",
      "affected": { "ge": "1.28.0", "lt": "1.32.1" } },
    { "cve": "CVE-2019-5747", "package": "busybox",
      "affected": { "versions": ["1.29.0", "1.29.1"] } }
  ]
}

For each advisory, every installed package with the matching name whose version falls inside affected produces a vulnerability violation at the advisory’s severity.

affected semantics:

• range operators lt / le / gt / ge / eq — ANDed (a half-open range);

• ``versions`` — an exact-match OR-list;

• omitted — every installed version is affected.

Version comparison follows Debian’s algorithm (optional epoch:, the ~ pre-release marker, numeric segments compared by value so 1.10 > 1.9).

Building the feed from OSV

tools/delta-feed.py converts OSV records into the advisory schema above, so you can drive Delta from a public vulnerability database without hand-authoring the feed:

# a single record, a directory dump, or stdin
tools/delta-feed.py osv2feed osv-export/ -o advisories.json
tools/delta-feed.py osv2feed CVE-2022-0778.json

Each OSV affected range’s introduced / fixed events become ge / lt operators, an explicit versions list becomes the exact-match OR-list, a CVE alias is preferred over the OSV id, and GIT (commit-hash) ranges are skipped as non-version-comparable. Records are de-duplicated across inputs. The feed it produces is distributed to devices like any other — e.g. served from the config_url the control plane already fetches (Shipping reports to a server).

Exporting an SBOM

The same tool exports the collected package inventory as a standard SBOM, so Delta’s view of a device or image plugs into existing supply-chain tooling:

delta --root /mnt/image --packages --baseline sbom-base.json
tools/delta-feed.py sbom --format cyclonedx sbom-base.json -o sbom.cdx.json
tools/delta-feed.py sbom --format spdx      sbom-base.json -o sbom.spdx.json

cyclonedx emits CycloneDX 1.5 (components), spdx emits SPDX 2.3 (packages); both carry a pkg:generic/<name>@<version> purl per package. The tool is dependency-free Python 3; tests/scripts/test_feed_tool.sh smoke- tests both directions.