Capture Trivy fix status and package classification per finding

src/DockerUpdateGuard.Data/Configurations/VulnerabilityFindingConfiguration.cs

@@ -47,9 +47,18 @@ public void Configure(EntityTypeBuilder<VulnerabilityFinding> builder)
         builder.Property(entity => entity.CvssScore)
                .HasPrecision(5, 2);
 
+        builder.Property(entity => entity.PackageClass)
+               .HasMaxLength(50);
+
+        builder.Property(entity => entity.PackageType)
+               .HasMaxLength(50);
+
         builder.Property(entity => entity.Source)
                .IsRequired();
 
+        builder.Property(entity => entity.FixStatus)
+               .IsRequired();
+
         builder.Property(entity => entity.DetectedAtUtc)
                .IsRequired();
 

src/DockerUpdateGuard.Data/Entities/VulnerabilityFinding.cs

@@ -62,6 +62,21 @@ public class VulnerabilityFinding
     /// </summary>
     public VulnerabilitySource Source { get; set; }
 
+    /// <summary>
+    /// Fix status reported by the provider, <see cref="VulnerabilityFixStatus.NotSet"/> when the provider supplies none
+    /// </summary>
+    public VulnerabilityFixStatus FixStatus { get; set; }
+
+    /// <summary>
+    /// Optional package class the finding was reported for (e.g. os-pkgs, lang-pkgs)
+    /// </summary>
+    public string? PackageClass { get; set; }
+
+    /// <summary>
+    /// Optional distribution or ecosystem the finding was reported for (e.g. alpine, gobinary)
+    /// </summary>
+    public string? PackageType { get; set; }
+
     /// <summary>
     /// Optional CVSS score
     /// </summary>

src/DockerUpdateGuard.Data/Entities/VulnerabilityFixStatus.cs

@@ -0,0 +1,37 @@
+namespace DockerUpdateGuard.Data.Entities;
+
+/// <summary>
+/// Fix status reported by the vulnerability provider for a finding
+/// </summary>
+public enum VulnerabilityFixStatus
+{
+    /// <summary>
+    /// No fix status set because the provider reported none or reported it as unknown
+    /// </summary>
+    NotSet = 0,
+
+    /// <summary>
+    /// A fixed package version is available upstream
+    /// </summary>
+    Fixed = 1,
+
+    /// <summary>
+    /// The package is affected and no fix is available yet
+    /// </summary>
+    Affected = 2,
+
+    /// <summary>
+    /// Upstream decided not to fix the vulnerability
+    /// </summary>
+    WillNotFix = 3,
+
+    /// <summary>
+    /// The affected package reached its end of life and receives no fix
+    /// </summary>
+    EndOfLife = 4,
+
+    /// <summary>
+    /// Upstream deferred the fix to a later point in time
+    /// </summary>
+    FixDeferred = 5
+}

src/DockerUpdateGuard.Data/Migrations/DockerUpdateGuardDbContextModelSnapshot.cs

@@ -715,6 +715,9 @@ protected override void BuildModel(ModelBuilder modelBuilder)
                     b.Property<DateTimeOffset>("DetectedAtUtc")
                         .HasColumnType("timestamp with time zone");
 
+                    b.Property<int>("FixStatus")
+                        .HasColumnType("integer");
+
                     b.Property<string>("FixedVersion")
                         .HasMaxLength(100)
                         .HasColumnType("character varying(100)");
@@ -729,6 +732,14 @@ protected override void BuildModel(ModelBuilder modelBuilder)
                     b.Property<bool>("IsActive")
                         .HasColumnType("boolean");
 
+                    b.Property<string>("PackageClass")
+                        .HasMaxLength(50)
+                        .HasColumnType("character varying(50)");
+
+                    b.Property<string>("PackageType")
+                        .HasMaxLength(50)
+                        .HasColumnType("character varying(50)");
+
                     b.Property<string>("ReferenceUrl")
                         .HasColumnType("text");