vex

type AppliedStatement struct {
	VulnID     string     `json:"vulnId"`
	Purl       string     `json:"purl,omitempty"`
	Status     Status     `json:"status"`
	Suppressed bool       `json:"suppressed"`
	Basis      MatchBasis `json:"basis"`
	Explain    string     `json:"explain"`
	Source     string     `json:"source,omitempty"`
}

type Document struct {
	Format     Format      `json:"format"`
	ID         string      `json:"id,omitempty"`
	Author     string      `json:"author,omitempty"`
	Path       string      `json:"path,omitempty"`
	Statements []Statement `json:"statements"`
}

type Finding struct {
	// VulnID is the vulnerability identifier as the scanner reports it.
	VulnID string
	// Purl identifies the affected component, when known.
	Purl string
	// Name and Version are the fallback identity for a finding with no purl.
	Name    string
	Version string
}

type Format string

type Match struct {
	Statement Statement  `json:"statement"`
	Basis     MatchBasis `json:"basis"`
	// Explain is a human sentence saying why this statement was applied.
	Explain string `json:"explain"`
}

type MatchBasis string

type Problem struct {
	// StatementIndex is the position of the offending statement, or -1 for a
	// document-level problem.
	StatementIndex int `json:"statementIndex"`
	// Message describes what is wrong.
	Message string `json:"message"`
	// Fatal marks a problem that makes the statement unusable, as opposed to
	// one that only makes it weaker.
	Fatal bool `json:"fatal"`
}

type Product struct {
	// Purl is the product's package URL, when it has one. This is the field
	// matching actually uses; ID is a fallback for documents that identify
	// products some other way.
	Purl string `json:"purl,omitempty"`
	// ID is the raw product identifier as written in the document.
	ID string `json:"id,omitempty"`
	// Versions are explicit versions the statement is scoped to. Empty means
	// the statement applies to every version of the product.
	Versions []string `json:"versions,omitempty"`
	// Subcomponents are purls the statement narrows to within the product.
	Subcomponents []string `json:"subcomponents,omitempty"`
}

type Result struct {
	// Total is every vulnerability entry considered.
	Total int `json:"total"`
	// Effective is the count still live after VEX.
	Effective int `json:"effective"`
	// Suppressed is the count a not_affected or fixed statement closed.
	Suppressed int `json:"suppressed"`
	// Annotated is the count that gained an analysis block without being
	// suppressed — an `affected` statement adds an action statement, which is
	// useful, but does not close anything.
	Annotated int `json:"annotated"`
	// Applied lists each finding a statement reached, for reporting.
	Applied []AppliedStatement `json:"applied,omitempty"`
	// Unmatched is the number of statements that matched no finding. A high
	// count usually means the documents are about a different product, which
	// is worth telling the user rather than silently doing nothing.
	Unmatched int `json:"unmatchedStatements"`
}

type Set struct {
	// contains filtered or unexported fields
}

type Statement struct {
	// VulnID is the vulnerability identifier, normalised to a bare id.
	VulnID string `json:"vulnId"`
	// Aliases are other identifiers for the same vulnerability.
	Aliases []string `json:"aliases,omitempty"`
	// Status is the assertion.
	Status Status `json:"status"`
	// Justification explains a not_affected status.
	Justification string `json:"justification,omitempty"`
	// ImpactStatement is free text supporting a not_affected status.
	ImpactStatement string `json:"impactStatement,omitempty"`
	// ActionStatement is what the consumer should do about an affected status.
	ActionStatement string `json:"actionStatement,omitempty"`
	// Products are the things this statement is about. Empty means the
	// statement applies to the document's whole subject.
	Products []Product `json:"products,omitempty"`
	// Timestamp is when the assertion was made. Used to pick a winner when two
	// statements cover the same (vulnerability, product).
	Timestamp time.Time `json:"timestamp,omitempty"`
	// Source describes where the statement came from, for attribution in
	// output — a suppressed finding must always be traceable to the document
	// that suppressed it.
	Source StatementSource `json:"source"`
}

type StatementSource struct {
	// Path is the file the statement was read from.
	Path string `json:"path,omitempty"`
	// Format is the serialisation it was written in.
	Format Format `json:"format"`
	// DocumentID is the document's own identifier.
	DocumentID string `json:"documentId,omitempty"`
	// Author is who published it.
	Author string `json:"author,omitempty"`
}

type Status string

type WriteOptions struct {
	// ID is the document identifier. Generated when empty.
	ID string
	// Author is the document author.
	Author string
	// Tooling identifies what produced the document.
	Tooling string
	// Now overrides the timestamp, for deterministic tests.
	Now time.Time
}