Capture Trivy fix status and package classification per finding - #218
Closed
LarsLaskowski wants to merge 1 commit into
Closed
Capture Trivy fix status and package classification per finding#218LarsLaskowski wants to merge 1 commit into
LarsLaskowski wants to merge 1 commit into
Conversation
Trivy reports a per-vulnerability Status and a per-result-block Class and Type, all of which were discarded on parse. The Trivy payload records now carry these values, the provider projects each vulnerability together with its own result block so the block-level class and type are attributed correctly, and the values travel through the advisory transport into the new FixStatus, PackageClass and PackageType columns added by migration Update7. Unrecognized and unknown status strings fall back to NotSet, and finding identity stays AdvisoryId plus AffectedPackage so a re-scan updates existing rows instead of duplicating them. Refs #207
|
Owner
Author
|
PR was created twice |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Parses the per-vulnerability
Statusand the per-result-blockClass,TypeandTargetfrom the Trivy report and persists the fix status and package classification with each vulnerability finding.TrivyVulnerabilitygainsStatus;TrivyResultgainsTarget,ClassandType.TrivyVulnerabilityProviderprojects each vulnerability together with its own result block instead of flattening with a bareSelectMany, so block-level values are attributed to the vulnerabilities inside that block. Blank block values are normalized to null.VulnerabilityFixStatusenum (NotSet,Fixed,Affected,WillNotFix,EndOfLife,FixDeferred), mapped case-insensitively from the Trivy status strings.VulnerabilityAdvisoryDataandVulnerabilityFindingcarryFixStatus,PackageClassandPackageType; migrationUpdate7adds the three columns.VulnerabilityEnrichmentService.UpdateFindingFromAdvisorycopies the new values like the other mutable fields.Why
"Fixable" was inferred solely from a non-empty
FixedVersion, so an empty value could equally mean "upstream will not fix", "fix deferred", "end of life" or "the provider reported nothing". Trivy distinguishes these, but the information was discarded on parse. Capturing it lets downstream features state upstream unfixability as a fact from the provider instead of inferring it from a missing field.Linked issues
Closes #207
Review notes
CreateFindingKeystill usesAdvisoryIdplusAffectedPackage, so a re-scan updates existing rows rather than creating new ones.unknownstatus maps toNotSet, as do unrecognized and missing status strings. Consumers must treatNotSetas "no information" and fall back to theFixedVersionheuristic rather than reporting "not fixable".NotSetand null until then.Follow-up work
None