vex

type Claim struct {
	// Vulnerability is the identifier the statement is about, e.g. "CVE-2024-1234".
	Vulnerability string
	// PURL is the package the claim applies to, the subcomponent when the statement named one,
	// otherwise the product itself. Empty when the statement identified neither by package URL, in
	// which case the claim applies to every finding for that vulnerability in the component that
	// declared the source. See Index.
	PURL string
	// Status is the claim: not_affected, affected, fixed, under_investigation.
	Status string
	// Justification is VEX's vocabulary term, present only with not_affected.
	Justification string
	// Statement is the prose the supplier gave, impact_statement for not_affected, otherwise
	// action_statement or status_notes. What a reader needs when deciding whether to believe it.
	Statement string
	// Author is who asserted it, carried from the document so a claim never travels anonymously.
	Author string
	// Source is the document this came from, for the same reason.
	Source string
	// Timestamp is when the claim was made, statement-level where the statement carried one and
	// the document's otherwise.
	Timestamp string
}

type Document struct {
	// Context is the spec IRI the document claims, e.g. https://openvex.dev/ns/v0.2.0.
	Context string `json:"@context"`
	// ID identifies this document. Reported so a reader can tell two revisions apart.
	ID string `json:"@id"`
	// Author is who is making these statements. The single most important field here: a VEX
	// statement's weight is entirely a function of who signed it, and a document that does not
	// say is one a reader has to be told about rather than quietly obeyed.
	Author string `json:"author"`
	// Timestamp is when the document was made. A supplier's claim is made at a time they chose,
	// not when you scanned, so the report shows its age rather than presenting it as fresh.
	Timestamp string `json:"timestamp"`
	// Version increments as a document is revised.
	Version int `json:"version"`
	// Statements are the claims themselves.
	Statements []Statement `json:"statements"`
}

type Index struct {
	// contains filtered or unexported fields
}

type Product struct {
	ID            string         `json:"@id"`
	Subcomponents []Subcomponent `json:"subcomponents,omitempty"`
}

type Provenance struct {
	// Kind is how the document was reached: "path", "url" or "repository".
	Kind string
	// Location is the path, URL, or `repository#path` as the descriptor named it.
	Location string
	// Revision is the commit a repository source actually read. Empty for the others.
	//
	// Resolved even when the descriptor named a branch, which is the point: a ref that moves
	// makes a run unreproducible unless the commit it resolved to is written down.
	Revision string
	// Digest is the sha256 of the bytes read, so two runs can be compared without the document.
	Digest string
	// ReadAt is when Draugr read it, distinct from the document's own timestamp, and the pair is
	// what tells a reader whether they are looking at a fresh copy of a stale claim.
	ReadAt time.Time
	// Author is the document's author, carried up so the report can attribute without reparsing.
	Author string
	// Timestamp is the document's own, as written.
	Timestamp string
	// Statements is how many claims the document carried.
	Statements int
	// Applied is how many of them matched a finding. Zero against a non-zero Statements is worth
	// seeing: a document that excused nothing is indistinguishable from one that was never read,
	// and usually means the supplier and the scanner name packages differently.
	Applied int
}

type Resolved struct {
	Document   Document
	Provenance Provenance
}

type Set struct {
	Project     []Resolved
	ByComponent map[string][]Resolved
}

type Statement struct {
	Vulnerability Vulnerability `json:"vulnerability"`
	// Products are what the statement is about, the supplier's own artifact.
	Products []Product `json:"products"`
	// Status is the claim: not_affected, affected, fixed or under_investigation.
	Status string `json:"status"`
	// Justification is the machine-readable why, from VEX's fixed vocabulary, valid only with
	// not_affected.
	Justification string `json:"justification,omitempty"`
	// ImpactStatement is the prose why, which VEX accepts in place of a justification.
	ImpactStatement string `json:"impact_statement,omitempty"`
	// ActionStatement is what is being done about an affected product.
	ActionStatement string `json:"action_statement,omitempty"`
	// StatusNotes is free text the producer attached to the status.
	StatusNotes string `json:"status_notes,omitempty"`
	// Timestamp overrides the document's, when a single statement was revised on its own.
	Timestamp string `json:"timestamp,omitempty"`
}

type Subcomponent struct {
	ID string `json:"@id"`
}

type Vulnerability struct {
	Name string `json:"name"`
}