--format sarif writes SARIF 2.1.0 (one result per affected finding, error/warning/note levels); --format csv writes one row per finding with every field quoted and a ' guard before = + - @ so spreadsheets do not execute formulas; --format markdown writes a table per target.

JSON schema

amivuln -f json writes one document per run. The schema is published as v1.json (also served as https://nubian-ibex.github.io/amivuln/schema/v1.json) and the project’s tests validate the real output against it.

The suppressed array (all documents) lists accepted findings. The cve and pending commands write their own documents ("kind": "cve" and "kind": "pending") with the schemas cve-v1.json, pending-v1.json and, for restart, restart-v1.json. The run report also carries a score object.

Rules:

• schema_version is bumped on every incompatible change; adding optional fields does not bump it.
• findings (affected) and unverified are separate arrays.
• A finding id is a CVE id, or a distribution update id when the update names no CVE.
• complete: false means a required source failed. Treat it as unknown, not as clean.
• The host object only ever holds os_id, os_version and arch.

Validate a document:

check-jsonschema --schemafile v1.json amivuln.json