feat: Expose Ubuntu fix status for downstream consumption

pkg/types/status.go

@@ -11,6 +11,9 @@ var (
 	//
 	// In addition to them, Red Hat has "will_not_fix" and "fix_deferred".
 	// cf. https://access.redhat.com/blogs/product-security/posts/2066793
+	//
+	// In addition to them, Ubuntu has "DNE", "ignored", "needed", "pending"
+	// https://askubuntu.com/a/1509706
 	Statuses = []string{
 		"unknown",
 		"not_affected",
@@ -29,7 +32,7 @@ const (
 	StatusAffected
 	StatusFixed
 	StatusUnderInvestigation
-	StatusWillNotFix // Red Hat specific
+	StatusWillNotFix
 	StatusFixDeferred
 	StatusEndOfLife
 )

pkg/types/types.go

@@ -101,9 +101,8 @@ type Advisory struct {
 
 	Arches []string `json:",omitempty"`
 
-	// It is filled only when FixedVersion is empty since it is obvious the state is "Fixed" when FixedVersion is not empty.
-	// e.g. Will not fix and Affected
-	Status Status `json:"-"`
+	// This is used to provide the status when a status is known & support by the the vulnsrc
+	Status Status `json:",omitempty"`
 
 	// Trivy DB has "vulnerability" bucket and severities are usually stored in the bucket per a vulnerability ID.
 	// In some cases, the advisory may have multiple severities depending on the packages.

pkg/vulnsrc/ubuntu/testdata/vuln-list/ubuntu/CVE-2020-1234.json

@@ -19,12 +19,13 @@
       "bionic": {
         "Status": "released",
         "Note": "1.2.3"
-      },
-      "focal": {
-        "Status": "needs-triage",
-        "Note": ""
       }
-    }
-  },
-  "UpstreamLinks": {}
+    },
+    "trusty": {
+      "bionic": {
+        "Status": "deferred"
+      }
+    },
+    "UpstreamLinks": {}
+  }
 }

pkg/vulnsrc/ubuntu/ubuntu.go

@@ -23,7 +23,7 @@ const (
 )
 
 var (
-	targetStatuses        = []string{"needed", "deferred", "released"}
+	targetStatuses        = []string{"ignored", "needed", "pending", "deferred", "released"}
 	UbuntuReleasesMapping = map[string]string{
 		"precise": "12.04",
 		"quantal": "12.10",
@@ -170,8 +170,12 @@ func defaultPut(dbc db.Operation, tx *bolt.Tx, advisory interface{}) error {
 			}
 
 			adv := types.Advisory{}
-			if status.Status == "released" {
+			normalised_status := StatusFromUbuntuStatus(status.Status)
+			if normalised_status == types.StatusFixed {
 				adv.FixedVersion = status.Note
+			} else {
+				// Store the status only if it's unfixed
+				adv.Status = normalised_status
 			}
 			if err := dbc.PutAdvisoryDetail(tx, cve.Candidate, pkgName, []string{platformName}, adv); err != nil {
 				return xerrors.Errorf("failed to save Ubuntu advisory: %w", err)
@@ -213,3 +217,17 @@ func SeverityFromPriority(priority string) types.Severity {
 		return types.SeverityUnknown
 	}
 }
+
+// StatusFromUbuntuStatus normalises Ubuntu status into common Trivy Types
+func StatusFromUbuntuStatus(status string) types.Status {
+	switch status {
+	case "ignored":
+		return types.StatusWillNotFix
+	case "needed", "pending", "deferred":
+		return types.StatusFixDeferred
+	case "released":
+		return types.StatusFixed
+	default:
+		return types.StatusUnknown
+	}
+}

pkg/vulnsrc/ubuntu/ubuntu_test.go

@@ -3,6 +3,8 @@ package ubuntu_test
 import (
 	"testing"
 
+	"github.com/stretchr/testify/assert"
+
 	"github.com/aquasecurity/trivy-db/pkg/types"
 	"github.com/aquasecurity/trivy-db/pkg/vulnsrc/ubuntu"
 	"github.com/aquasecurity/trivy-db/pkg/vulnsrc/vulnerability"
@@ -35,6 +37,12 @@ func TestVulnSrc_Update(t *testing.T) {
 						FixedVersion: "1.2.3",
 					},
 				},
+				{
+					Key: []string{"advisory-detail", "CVE-2020-1234", "ubuntu 18.04", "trusty"},
+					Value: types.Advisory{
+						Status: types.StatusFixDeferred,
+					},
+				},
 				{
 					Key: []string{"vulnerability-detail", "CVE-2020-1234", "ubuntu"},
 					Value: types.VulnerabilityDetail{
@@ -60,3 +68,49 @@ func TestVulnSrc_Update(t *testing.T) {
 		})
 	}
 }
+
+func TestUbuntuStatusFromStatus(t *testing.T) {
+	tests := []struct {
+		name     string
+		status   string
+		expected types.Status
+	}{
+		{
+			name:     "ignored",
+			status:   "ignored",
+			expected: types.StatusWillNotFix,
+		},
+		{
+			name:     "deferred",
+			status:   "deferred",
+			expected: types.StatusFixDeferred,
+		},
+		{
+			name:     "needed",
+			status:   "needed",
+			expected: types.StatusFixDeferred,
+		},
+		{
+			name:     "pending",
+			status:   "pending",
+			expected: types.StatusFixDeferred,
+		},
+		{
+			name:     "released",
+			status:   "released",
+			expected: types.StatusFixed,
+		},
+		{
+			name:     "unknown",
+			status:   "unknown",
+			expected: types.StatusUnknown,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			actual := ubuntu.StatusFromUbuntuStatus(test.status)
+			assert.Equal(t, test.expected, actual)
+		})
+	}
+}