CVM — Configuration Vulnerability Meter
CASPAR — the reference implementation

Copyright 2026 Alberto Filipe

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

--------------------------------------------------------------------------
Third-party material
--------------------------------------------------------------------------

The scoring method implements CCSS, the Common Configuration Scoring System,
specified in NISTIR 7502 (National Institute of Standards and Technology, US
Department of Commerce). NISTIR 7502 is a US Government publication and is not
subject to copyright in the United States.

The knowledge base is DERIVED from publicly available security benchmarks —
principally CIS Benchmarks (Center for Internet Security) and DISA STIGs
(Defense Information Systems Agency). What ships here are machine-extracted
rules with their own CCSS metrics, justifications and remediations, together
with a per-target record of which benchmark they were derived from; the
benchmark documents themselves are neither redistributed nor included. CIS
Benchmarks are the property of the Center for Internet Security and are
distributed under their own terms; DISA STIGs are US Government works.

Building a new target from a benchmark PDF requires the operator to supply that
document themselves, under whatever terms they obtained it. Benchmark PDFs are
excluded from this repository, from the Python distributions and from the
container images.

The SCAP Security Guide (ComplianceAsCode/content) is used as a source of
hardening content, pinned by version with its SHA recorded in each scan's
reproducibility manifest. It is licensed BSD-3-Clause:

    Copyright (c) 2012-2017, Red Hat, Inc. All rights reserved.
    https://github.com/ComplianceAsCode/content/blob/master/LICENSE

Its release archives are downloaded by the operator at build time and are not
redistributed here.

Third-party Python and JavaScript dependencies are installed from their own
distributions and retain their own licences; none is vendored into this
repository.
