Capture Trivy fix status and package class on vulnerability findings - #217
Merged
Conversation
Trivy reports a per-vulnerability Status and a per-result-block Class and Type, all of which were discarded on parse. The Trivy payload records now carry these values, the provider projects each vulnerability together with its owning result block so the block-level classification is attributed correctly, and the values flow through the advisory transport into the persisted finding via migration Update7. Unknown or missing statuses map to the new VulnerabilityFixStatus.NotSet, and the finding identity remains AdvisoryId plus AffectedPackage so a re-scan does not duplicate rows. Refs #207
The quality gate reported 72.9 percent coverage on new code because the Update7 migration contributed 23 uncovered lines. Update7MigrationTests now asserts the added columns, their defaults and the rollback following the Update6 pattern, and MappingTests checks the new mapping and round-trip plus the unchanged finding identity index. Additional tests cover blank and padded Trivy block values, Docker Scout advisories leaving the fields unset, and a reactivated finding taking over the reported values. Refs #207
…aude/issue-207-1vrhhu
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
StatustoTrivyVulnerabilityandTarget,ClassandTypetoTrivyResult.TrivyVulnerabilityProvidernow projects over(result, vulnerability)pairs instead of a bareSelectMany, so the block-level class and type are attributed to the vulnerabilities inside that block.VulnerabilityFixStatusenum (NotSet,Fixed,Affected,WillNotFix,FixDeferred,EndOfLife) with case-insensitive mapping from Trivy's status strings.VulnerabilityAdvisoryDataandVulnerabilityFindingcarryFixStatus,PackageClassandPackageType; mapping added toVulnerabilityFindingConfigurationand persisted through migrationUpdate7.VulnerabilityEnrichmentService.UpdateFindingFromAdvisorycopies the new values on both insert and update.Why
"Fixable" was inferred solely from a non-empty
FixedVersion, so an empty value could equally mean "upstream will not fix", "fix deferred", "end of life" or "the provider reported nothing". Trivy distinguishes these through its per-vulnerabilityStatusfield and the per-result-blockClass/Type, but all of it was discarded on parse. Storing the provider's own values lets downstream features separate "you can fix this by updating the image" from "upstream has no fix" instead of guessing from a missing field.Linked issues
Closes #207
Review notes
CreateFindingKey, so a re-scan after the migration updates existing rows rather than creating new ones.unknownstatus maps toNotSetalongside unrecognized and missing values; consumers must treatNotSetas "no information" and fall back to theFixedVersionheuristic rather than reporting "not fixable".NotSetuntil the image is scanned again, since the migration only adds the columns.DockerScoutVulnerabilityProviderandDefaultVulnerabilityProviderdo not supply the data and leave the values atNotSet/null.Follow-up work
None — surfacing the new values in the UI is left to the consuming feature.