fedora-cve-triage(1)

💖 fedora-cve-triage — the bestie manual 💖

okay so literally welcome to fedora-cve-triage (that's the name, that's the whole vibe), a tool for triaging CVEs reported against Fedora components in Bugzilla. she's from the Sandogasa manual, she's giving very much "I sort your security chaos for you" energy, and I'm gonna walk you through every single flag because you deserve to know. no gatekeeping here. 🎀

---

✨ SYNOPSIS ✨

fedora-cve-triage [-v|--verbose] [--refresh] [-h|--help] [-V|--version]
<subcommands>

---

🌸 DESCRIPTION 🌸

A tool for triaging CVEs reported against Fedora components in Bugzilla. that's it, that's the mission, and honestly? iconic. 💅

---

🦋 OPTIONS 🦋

these are the global lil guys, and yes they show up again in the subcommands (consistency queen):

• -v, --verbose — shows you the progress details for those rate-limited API queries, so you're not just staring at a cursor like 👁️👄👁️
• --refresh — throws away every answer kept between runs under the cache directory (that's NVD, advisory pages, and Koji builds) and goes and fetches everything fresh. main character energy: out with the old ✨
• -h, --help — prints help. your safety net, always there 🫶
• -V, --version — prints the version, for when you need receipts

---

👑 COMMANDS 👑

🧚 fedora-cve-triage config

fedora-cve-triage config [-v|--verbose] [--refresh] [-h|--help]

Sets up or verifies your Bugzilla API key configuration. basically the "let's get you logged in, bestie" moment 🔑

• -v, --verbose — show progress details for rate-limited API queries
• --refresh — ignore every answer kept between runs under the cache directory (NVD, advisory pages, Koji builds) and fetch afresh
• -h, --help — print help

---

🔥 fedora-cve-triage run

fedora-cve-triage run [-f|--config] [-v|--verbose] [-c|--component]
[--refresh] [-a|--assignee] [-y|--yes] [--claim] [--skip-component]
[-s|--status] [--check] [--apply] [--edit-bodhi] [-h|--help]

Applies every classifier to one bug population, in order. like a lil assembly line but make it security 🏭✨

• -f, --config <CONFIG> — path to the TOML config file. default is run.toml in /etc/fedora-cve-triage/, merged under ~/.config/
• -v, --verbose — show progress details for rate-limited API queries
• -c, --component <NAME,...> — limit the run to these components. CSV or repeated, and yes a glob like rust-* selects every component matching it. go off 💫
• --refresh — ignore every answer kept between runs under the cache directory (NVD, advisory pages, Koji builds) and fetch afresh
• -a, --assignee <EMAIL,...> — limit the run to these assignees. CSV or repeated
• -y, --yes — answer yes to every prompt, skipping the per-bug review. chaos mode, but consensual 🤝
• --claim — reassign the bugs to your configured email without asking. bold. love that for you
• --skip-component <NAME,...> — components to leave out. CSV or repeated, globs allowed
• -s, --status <STATUS,...> — bug statuses to sweep. CSV or repeated, and this overrides the config's statuses
• --check <NAME,...> — checks to run, in order. CSV or repeated, and this overrides the config's checks
• --apply — apply each check's changes. default is preview only, so nothing spicy happens until you say so
• --edit-bodhi — add bugs to testing updates. requires the bodhi CLI, so make sure she's installed first 🌈
• -h, --help — print help

---

💜 fedora-cve-triage search

fedora-cve-triage search [-v|--verbose] [-c|--component] [--refresh]
[-a|--assignee] [-s|--status] [-h|--help] <-p|--product>

Searches Bugzilla for CVE bugs. the detective era 🔍

• -p, --product <PRODUCT> — the Bugzilla product (e.g. "Security Response", "Fedora", "FedoraEPEL" — wait, fr fr it's "Fedora EPEL") — required, so don't forget her!
• -v, --verbose — show progress details for rate-limited API queries
• -c, --component <COMPONENT> — Bugzilla component, typically the source RPM name (e.g. "vulnerability", "kernel")
• --refresh — ignore every answer kept between runs under the cache directory (NVD, advisory pages, Koji builds) and fetch afresh
• -a, --assignee <ASSIGNEE> — filter bugs by assignee email address
• -s, --status <STATUS> — bug status filter. default: NEW
• -h, --help — print help

---

💀 reminder bestie: --apply is the one that actually writes changes. default is preview only for a reason. read twice, run once, mwah 😘

---

okay that's the whole page!! this was sandogasa 0.27.0, dated 2026-10-21, and I'm obsessed with her honestly. go triage those CVEs, you absolute legend. slay, periodt, no cap. 💖✨🎀🦋🌸💅🫶