inventory

type AdvisoryID struct {
	Publisher string // e.g. "CVE".
	Reference string // e.g. "CVE-2023-1234".
}

type Finding struct {
	PackageVulns    []*PackageVuln
	GenericFindings []*GenericFinding
}

type GenericFinding struct {
	// Info specific to the vuln. Should always be the same for the same type of vuln.
	Adv *GenericFindingAdvisory
	// Instance-specific info such as location of the vulnerable files.
	Target *GenericFindingTargetDetails
	// The plugins (e.g. Detectors, Enrichers) that found this vuln.
	Plugins []string
	// Signals that indicate this finding is not exploitable.
	ExploitabilitySignals []*vex.FindingExploitabilitySignal
}

type GenericFindingAdvisory struct {
	// A unique ID for the finding.
	ID *AdvisoryID
	// Title, short description and recommendation steps for the finding. Users should be able to rely
	// on these fields to understand the vulnerability and remediate it.
	// Title of the finding, e.g. "CVE-2024-1234 - RCE Vulnerability on Foo".
	Title string
	// Description of the finding, e.g. "Foo prior to version 1.2.3 is affected by a Remote Code
	// Execution vulnerability.".
	Description string
	// Recommendation for how to remediate the finding, e.g. "Upgrade Foo to version 1.2.4 or
	// higher.".
	Recommendation string
	Sev            SeverityEnum
}

type GenericFindingTargetDetails struct {
	// Free-text info.
	Extra string
}

type Inventory struct {
	Packages        []*extractor.Package
	PackageVulns    []*PackageVuln
	GenericFindings []*GenericFinding
	Secrets         []*Secret
}

type PackageVuln struct {
	osvschema.Vulnerability

	// The extracted package associated with this vuln.
	Package *extractor.Package
	// The plugins (e.g. Detectors, Enrichers) that found this vuln.
	Plugins []string
	// Signals that indicate this finding is not exploitable.
	ExploitabilitySignals []*vex.FindingExploitabilitySignal
}

type Secret struct {
	Secret   veles.Secret
	Location string

	Validation SecretValidationResult
}

type SecretValidationResult struct {
	// At is the time at which the validation was performed.
	At time.Time
	// Status is the ValidationStatus obtained from the Validation.
	Status veles.ValidationStatus
	// Err is only set in case Status is ValidationFailed. In that case, it
	// contains the error encountered during validation.
	Err error
}

type SeverityEnum int