vexpr

type Doc struct {
	Context string `json:"@context"`
	ID      string `json:"@id,omitempty"`
	Author  string `json:"author"`
	// Version is any rather than int because published hubs disagree about it:
	// OpenVEX calls for a number and some tooling writes "1" as a string. A
	// typed int made the string form a decode failure, and a decode failure in
	// this package used to mean the document was replaced wholesale. Nothing
	// here reads the value -- a preserved document re-emits it verbatim -- so
	// the loosest type that round-trips is the right one.
	Version    any         `json:"version"`
	Timestamp  string      `json:"timestamp"`
	Statements []Statement `json:"statements"`
	// contains filtered or unexported fields
}

type FileChange struct {
	Path    string
	Content []byte
}

type HubReader interface {
	// IndexRaw is index.json exactly as published.
	IndexRaw() []byte
	// Raw returns one file's bytes by a location the index gave, or ok=false
	// when the hub has no such file.
	Raw(ctx context.Context, loc string) ([]byte, bool, error)
}

type Options struct {
	// Hub is the hub to merge against, read-only. Nil starts from an empty
	// index, which is how a hub gets bootstrapped rather than added to.
	Hub HubReader
	// Author is the OpenVEX author recorded on every statement written. It has
	// no default: an author is a claim of responsibility for the assertion, and
	// there is nobody but the caller who can make it.
	Author string
	// Timestamp is the scan time, used on every statement so a re-run of the
	// same scan produces the same document.
	Timestamp string
	// Logf receives progress lines. Nil discards them.
	Logf func(string, ...any)
}

type Plan struct {
	Changes    []FileChange
	Products   []ProductChange
	Statements int
	// Skipped is how many ruled-out findings could not be written as a
	// matchable statement (no product, component or id).
	Skipped int
	// Unparsable is every hub document that exists but could not be decoded,
	// and was therefore left exactly as the hub published it. Reported rather
	// than counted silently: each one is a product this proposal says nothing
	// about, and a reader would otherwise have no way to tell that from a
	// product with nothing to say.
	Unparsable []string
}

type Product struct {
	ID            string         `json:"@id"`
	Subcomponents []Subcomponent `json:"subcomponents,omitempty"`
}

type ProductChange struct {
	Product string
	Vulns   []string
}

type ProductProposal struct {
	// Product is the artifact purl the statements are filed under.
	Product string
	// Statements are the not_affected claims, one per ruled-out finding, sorted
	// so a repeated run produces a byte-identical document.
	Statements []Statement
}

type Statement struct {
	Vulnerability Vulnerability `json:"vulnerability"`
	Products      []Product     `json:"products"`
	Status        string        `json:"status"`
	Justification string        `json:"justification,omitempty"`
	// ImpactStatement is the author's own sentence explaining the conclusion.
	// For a vexscan-authored statement it is how the tool reached the verdict,
	// which is the single most useful field for a human reviewing the PR.
	ImpactStatement string `json:"impact_statement,omitempty"`
	ActionStatement string `json:"action_statement,omitempty"`
	Timestamp       string `json:"timestamp,omitempty"`
	// contains filtered or unexported fields
}

type Subcomponent struct {
	ID string `json:"@id"`
}

type Vulnerability struct {
	Name    string   `json:"name"`
	ID      string   `json:"@id,omitempty"`
	Aliases []string `json:"aliases,omitempty"`
}