changefeed

CVE / advisory subscription monitor via OSV.dev — pairs with cmdb and notify

v1.0.0

NixOS x86_64

Quick start

Install via jcli (recommended)

jcli install changefeed

If you don't have jcli yet, install it first with curl -fsSL https://cli.johlem.net/tools/jcli/install.sh | bash.

Install directly

curl -fsSL https://cli.johlem.net/install.sh | bash -s -- changefeed

Ed25519 signature verification is mandatory by default; set ALLOW_UNVERIFIED=1 to explicitly opt out (not recommended).

Run it

changefeed --help                # subcommand catalogue + flags
changefeed --full                # extended help across every subcommand
changefeed --about               # machine-readable attribution (JSON)
changefeed --version             # version string

What it does

changefeed is the monitoring half of pkgaudit: maintain a list of subscribed packages (Cargo / npm / PyPI / Go) and poll OSV.dev for new advisories, surfacing ONLY OSV ids that haven't been seen before. Drop in a cron job, pipe `poll -F jfind` into `notify`, and you have an asynchronous CVE alert pipeline. Five subcommands: subscribe / unsubscribe / list / poll / from-cmdb (v1.1 placeholder). State under $XDG_DATA_HOME/cli-johlem/changefeed/ as subscriptions.toml + state.json (override with $CHANGEFEED_DIR). Every new advisory emits a jfind/v1 vulnerability finding pre-filled with DORA Art. 9 + Art. 28 (third-party ICT supply chain) + NIS2 Art. 21(2)(d) + ISO/IEC 27001:2022 A.5.21 controls and MITRE T1195.001 (Compromise Software Dependencies). poll --fail-on-new exits 4 when at least one new advisory lands — CI-friendly gate. poll --dry-run polls without persisting state. Suite app: blueteam. 11 integration tests; zero warnings.

Authorisation and warranty: use only in environments where you have explicit written authorisation. This tool is provided as-is with no warranty. Report vulnerabilities privately at security@johlem.net.

Compliance crosswalk

This table lists controls where changefeed's output may form part of the evidence set presented to an assessor. It does not claim changefeed alone satisfies any framework — every control still requires assessor judgment and typically evidence from other sources.

Schema: compliance-crosswalk/v1 · Machine-readable: tools/changefeed/compliance.json

ISO27001 — ISO/IEC 27001:2022

Ref	Name	How	Coverage
`A.5.7`	Threat intelligence	Continuous OSV/advisory subscription per monitored package.	evidences
`A.8.8`	Management of technical vulnerabilities	Notifies on new CVEs against inventoried packages.	evidences

NIS2 — NIS2 Directive (Dir. 2022/2555)

Ref	Name	How	Coverage
`Art. 21 §2(e)`	Vulnerability handling	Real-time advisory feed for known packages.	evidences

Release artefacts & provenance

Every signed release ships with checksum + signature sidecars plus a CycloneDX SBOM. Enterprise procurement can pin third-party components without unpacking the binary.

manifest.json — pinned SHA-256 + .sig URL + SBOM URL per platform
johlem-release.pub — Ed25519 public key used by signify -V (fingerprint: 4532510f…6748, pinned in jcli verify)
CHANGELOG.md — semver-tagged release notes
Security contact: security@johlem.net