inventory

type AdvisoryID struct {
	Publisher string // e.g. "CVE".
	Reference string // e.g. "CVE-2023-1234".
}

type EmbeddedFS struct {
	// Path is a unique identifier for the embedded filesystem.
	// It is typically formed by concatenating the path to the source file
	// with the partition index from which the filesystem was extracted.
	Path string

	// TempPaths holds temporary files or directories created during extraction.
	// These should be cleaned up once all extractors, annotators, and detectors
	// have completed their operations.
	// TempPaths will be set when there are temporary directories to clean up.
	TempPaths []string

	// GetEmbeddedFS is a function that mounts or initializes the underlying
	// embedded filesystem and returns a scalibrfs.FS interface for accessing it.
	// The returned filesystem should be closed or cleaned up by the caller
	// when no longer needed.
	GetEmbeddedFS func(context.Context) (scalibrfs.FS, error)
}

type Finding struct {
	PackageVulns    []*PackageVuln
	GenericFindings []*GenericFinding
}

type GenericFinding struct {
	// Info specific to the vuln. Should always be the same for the same type of vuln.
	Adv *GenericFindingAdvisory
	// Instance-specific info such as location of the vulnerable files.
	Target *GenericFindingTargetDetails
	// The plugins (e.g. Detectors, Enrichers) that found this vuln.
	Plugins []string
	// Signals that indicate this finding is not exploitable.
	ExploitabilitySignals []*vex.FindingExploitabilitySignal
}

type GenericFindingAdvisory struct {
	// A unique ID for the finding.
	ID *AdvisoryID
	// Title, short description and recommendation steps for the finding. Users should be able to rely
	// on these fields to understand the vulnerability and remediate it.
	// Title of the finding, e.g. "CVE-2024-1234 - RCE Vulnerability on Foo".
	Title string
	// Description of the finding, e.g. "Foo prior to version 1.2.3 is affected by a Remote Code
	// Execution vulnerability.".
	Description string
	// Recommendation for how to remediate the finding, e.g. "Upgrade Foo to version 1.2.4 or
	// higher.".
	Recommendation string
	Sev            SeverityEnum
}

type GenericFindingTargetDetails struct {
	// Free-text info.
	Extra string
}

type Inventory struct {
	Packages               []*extractor.Package
	PackageVulns           []*PackageVuln
	GenericFindings        []*GenericFinding
	Secrets                []*Secret
	ContainerImageMetadata []*extractor.ContainerImageMetadata
	EmbeddedFSs            []*EmbeddedFS
}

type PackageVuln struct {
	// The OSV vulnerability information.
	Vulnerability *osvpb.Vulnerability

	// The extracted package associated with this vuln.
	Package *extractor.Package
	// The plugins (e.g. Detectors, Enrichers) that found this vuln.
	Plugins []string
	// Signals that indicate this finding is not exploitable.
	ExploitabilitySignals []*vex.FindingExploitabilitySignal
}

type Secret struct {
	Secret   veles.Secret
	Location string

	Validation SecretValidationResult
}

type SecretValidationResult struct {
	// At is the time at which the validation was performed.
	At time.Time
	// Status is the ValidationStatus obtained from the Validation.
	Status veles.ValidationStatus
	// Err is only set in case Status is ValidationFailed. In that case, it
	// contains the error encountered during validation.
	Err error
}

type SeverityEnum int