Include OVAL files by default for offline use about sec-cvescan

[mssalvatore]

@markmorlino, how often is updated OVAL data generated?

[stevebeattie]

@mssalvatore it's generated immediately following the cve html pages in the same cron job, so as frequently as every hour.

[markmorlino]

OVAL seems to be about 11mb of tar.bz2 files right now

[mssalvatore]

@joemcmanus How fresh do we want the offline OVAL data to be?

[joemcmanus]

We could do it once a week? But I guess a problem would be everyone downloading new snaps each time we publish a new version.

[markmorlino]

I'm thinking out loud here, but could we make a content snap that had just the oval files in it, and then have cvescan use it if it was installed or go download oval if it was not installed?

[mssalvatore]

I was also toying with the content snap idea. I'd like to avoid pushing out a whole new version of CVEScan every time the OVAL updates.