cmdb

Lightweight asset inventory — hosts / services / owners with DORA Art. 8 + NIS2 Art. 21 metadata

v1.0.0

NixOS x86_64

Quick start

Install via jcli (recommended)

jcli install cmdb

If you don't have jcli yet, install it first with curl -fsSL https://cli.johlem.net/tools/jcli/install.sh | bash.

Install directly

curl -fsSL https://cli.johlem.net/install.sh | bash -s -- cmdb

Ed25519 signature verification is mandatory by default; set ALLOW_UNVERIFIED=1 to explicitly opt out (not recommended).

Run it

cmdb --help                # subcommand catalogue + flags
cmdb --full                # extended help across every subcommand
cmdb --about               # machine-readable attribution (JSON)
cmdb --version             # version string

What it does

cmdb is the foundational asset inventory for the cli.johlem.net suite. Hosts / services / owners go in a SQLite database under $XDG_DATA_HOME/cli-johlem/cmdb.db (override via $CMDB_DB) with DORA Art. 8 + NIS2 Art. 21(1)(a) metadata baked into every record: criticality (critical / important / standard / none), entity_type (DORA proportionality — credit-institution, payment-institution, …), business_line (matches roigen RT.04.01.05 vocab), data_location_country (ISO 3166-1 alpha-2). Seven subcommands: add / list / show / edit / rm / check (mark last_seen=now) / link (attach a finding URL — from credsweep, urlrecon, socialscope, … — to a specific asset). Downstream tools read cmdb as their target list: roigen RT.04.01 critical functions reference cmdb assets by id; hostwatch, avwatch, urlrecon batch mode all consume the inventory. `cmdb list -F jfind` and `cmdb show -F jfind` emit asset-inventory findings with DORA Art. 8 pre-filled (always) plus NIS2 Art. 21(1)(a) and ISO/IEC 27001:2022 A.5.9 for critical / important assets, so complymap and dossier consume the inventory the same way they consume any other finding. SQLite via rusqlite (bundled — no system libsqlite3). XDG paths via the directories crate. WAL journal, foreign keys on, schema versioned in a meta table. 6 unit + 14 integration tests; zero warnings.

Authorisation and warranty: use only in environments where you have explicit written authorisation. This tool is provided as-is with no warranty. Report vulnerabilities privately at security@johlem.net.

Compliance crosswalk

This table lists controls where cmdb's output may form part of the evidence set presented to an assessor. It does not claim cmdb alone satisfies any framework — every control still requires assessor judgment and typically evidence from other sources.

Schema: compliance-crosswalk/v1 · Machine-readable: tools/cmdb/compliance.json

DORA — Digital Operational Resilience Act (Reg. 2022/2554)

Ref	Name	How	Coverage
`Art. 8`	Identification of ICT-supported business functions + underlying assets	Asset inventory + business-function linkage table.	evidences

ISO27001 — ISO/IEC 27001:2022

Ref	Name	How	Coverage
`A.5.9`	Inventory of information + other associated assets	Asset table with ownership + criticality metadata.	evidences
`A.5.10`	Acceptable use of information + other associated assets	Records asset owner + acceptable-use metadata.	supports

NIS2 — NIS2 Directive (Dir. 2022/2555)

Ref	Name	How	Coverage
`Art. 21 §2(d)`	Supply-chain security including security-related aspects of relationships	Records third-party dependencies per asset.	supports

Release artefacts & provenance

Every signed release ships with checksum + signature sidecars plus a CycloneDX SBOM. Enterprise procurement can pin third-party components without unpacking the binary.

manifest.json — pinned SHA-256 + .sig URL + SBOM URL per platform
johlem-release.pub — Ed25519 public key used by signify -V (fingerprint: 4532510f…6748, pinned in jcli verify)
CHANGELOG.md — semver-tagged release notes
Security contact: security@johlem.net