Capture Trivy fix status and package class on vulnerability findings

src/DockerUpdateGuard.Data/Configurations/VulnerabilityFindingConfiguration.cs

@@ -50,6 +50,15 @@ public void Configure(EntityTypeBuilder<VulnerabilityFinding> builder)
         builder.Property(entity => entity.Source)
                .IsRequired();
 
+        builder.Property(entity => entity.FixStatus)
+               .IsRequired();
+
+        builder.Property(entity => entity.PackageClass)
+               .HasMaxLength(50);
+
+        builder.Property(entity => entity.PackageType)
+               .HasMaxLength(50);
+
         builder.Property(entity => entity.DetectedAtUtc)
                .IsRequired();
 

src/DockerUpdateGuard.Data/Entities/VulnerabilityFinding.cs

@@ -62,6 +62,21 @@ public class VulnerabilityFinding
     /// </summary>
     public VulnerabilitySource Source { get; set; }
 
+    /// <summary>
+    /// Fix status reported by the provider
+    /// </summary>
+    public VulnerabilityFixStatus FixStatus { get; set; }
+
+    /// <summary>
+    /// Optional package class the finding belongs to (e.g. os-pkgs)
+    /// </summary>
+    public string? PackageClass { get; set; }
+
+    /// <summary>
+    /// Optional package type the finding belongs to (e.g. alpine)
+    /// </summary>
+    public string? PackageType { get; set; }
+
     /// <summary>
     /// Optional CVSS score
     /// </summary>

src/DockerUpdateGuard.Data/Entities/VulnerabilityFixStatus.cs

@@ -0,0 +1,37 @@
+namespace DockerUpdateGuard.Data.Entities;
+
+/// <summary>
+/// Fix status a vulnerability provider reported for a finding
+/// </summary>
+public enum VulnerabilityFixStatus
+{
+    /// <summary>
+    /// No fix status set, the provider did not report one
+    /// </summary>
+    NotSet = 0,
+
+    /// <summary>
+    /// A fixed package version is available upstream
+    /// </summary>
+    Fixed = 1,
+
+    /// <summary>
+    /// The package is affected and no fix has been published yet
+    /// </summary>
+    Affected = 2,
+
+    /// <summary>
+    /// Upstream declared that the vulnerability will not be fixed
+    /// </summary>
+    WillNotFix = 3,
+
+    /// <summary>
+    /// Upstream deferred the fix to a later point in time
+    /// </summary>
+    FixDeferred = 4,
+
+    /// <summary>
+    /// The affected package has reached its end of life and receives no fix
+    /// </summary>
+    EndOfLife = 5
+}

src/DockerUpdateGuard.Data/Migrations/DockerUpdateGuardDbContextModelSnapshot.cs

@@ -715,6 +715,9 @@ protected override void BuildModel(ModelBuilder modelBuilder)
                     b.Property<DateTimeOffset>("DetectedAtUtc")
                         .HasColumnType("timestamp with time zone");
 
+                    b.Property<int>("FixStatus")
+                        .HasColumnType("integer");
+
                     b.Property<string>("FixedVersion")
                         .HasMaxLength(100)
                         .HasColumnType("character varying(100)");
@@ -729,6 +732,14 @@ protected override void BuildModel(ModelBuilder modelBuilder)
                     b.Property<bool>("IsActive")
                         .HasColumnType("boolean");
 
+                    b.Property<string>("PackageClass")
+                        .HasMaxLength(50)
+                        .HasColumnType("character varying(50)");
+
+                    b.Property<string>("PackageType")
+                        .HasMaxLength(50)
+                        .HasColumnType("character varying(50)");
+
                     b.Property<string>("ReferenceUrl")
                         .HasColumnType("text");