<!-- START doctoc generated TOC please keep comment here to allow auto update -->
<!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE -->
**Table of Contents**  *generated with [DocToc](https://github.com/thlorenz/doctoc)*

- [`tools/cve-tool-vulnogram/`](#toolscve-tool-vulnogram)
  - [Prerequisites](#prerequisites)
  - [Operations](#operations)
  - [Configuration](#configuration)

<!-- END doctoc generated TOC please keep comment here to allow auto update -->

<!-- SPDX-License-Identifier: Apache-2.0
     https://www.apache.org/licenses/LICENSE-2.0 -->

# `tools/cve-tool-vulnogram/`

**Capability:** contract:cve-authority

**Kind:** implementation

**Vendor:** Vulnogram

**Organization:** ASF

ASF Vulnogram CVE-allocation client. OAuth-authenticated API that allocates a CVE ID through the ASF's Vulnogram instance and publishes the CVE record. Consumed by `security-cve-allocate`. See [`allocation.md`](allocation.md), [`record.md`](record.md), and [`bot-credits-policy.md`](bot-credits-policy.md) for the protocol.

## Prerequisites

- **Runtime:** Python 3.11+ run via `uv` (the `generate-cve-json` and `oauth-api` helpers are stdlib-only — no system install needed).
- **CLIs:** `gh` (authenticated) — `generate-cve-json` shells out to it for tracker/GitHub access.
- **Credentials / auth:** `gh auth status` must pass; the Vulnogram API helpers read a session token at `~/.config/apache-magpie/vulnogram-session.json` (mode `0600`, created by `vulnogram-api-setup`).
- **Network:** `cveprocess.apache.org` (Vulnogram session API) and `api.github.com` (via `gh`).

## Operations

This adapter implements the `tools/cve-tool/` CVE-authority contract for
ASF Vulnogram. The operation details live in [`allocation.md`](allocation.md)
for CVE ID allocation, [`record.md`](record.md) for record state changes,
and [`tool.md`](tool.md) for the shared protocol.

## Configuration

Adopters select this backend with `<project-config>/project.md` →
`cve_authority.tool: vulnogram`. The same block supplies the tenant URLs,
state names, reviewer channel, and publication signal fields documented in
`projects/_template/cve-allocation-config.md` and
`projects/_template/security-intake-config.md`.
