Conversation
…s range type advisoryReference maps a Solaris advisory id (the slug of the public Oracle security alert page) to its URL, toCveContentType and toVuls0Confidence get an ecosystem-keyed case, and selectFixedIn / comparePackStatus order solaris-ips versions with the range type's own comparator from vuls-data-update.
… neutral names in the test
GetCveContentTypes("solaris") returned nil, so the family-keyed helpers
(Titles, Summaries, CVSS scores, primary source URLs, the diff of updated
CVE info) skipped the solaris contents. Add the family constant and the
case, as for alpine.
…e test file so its _solaris suffix is not taken for a GOOS constraint
…rePackStatus The solaris-ips range type is used with Range bounds only: no data fills Affected.Fixed for it, so the two ordering cases never had anything to compare, and the comparator is not a total order and should not be used as one.
DetectPkgCves treated solaris as an unknown family and returned "Unsupported detection methods" for any scan result that carried packages. The family now joins the families vuls2 detects: a result with a release and packages goes to vuls2.DetectPkgs, which resolves the ecosystem (solaris:10 / solaris:11.<minor>) and compares the IPS package versions with the solaris-ips range type; a data-less or trivy result is recorded or skipped like the other recognized families. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Pins vuls2 to 53b151d (head of MaineK00n/vuls2#440) and vuls-data-update to 2fbef2f (head of MaineK00n/vuls-data-update#959): the solaris ecosystem (GetEcosystem for family "solaris") and the solaris-ips RangeType that the detector's solaris cases rely on. go mod tidy also raises packageurl-go to v0.1.7, which percent-encodes "&" in purl namespaces; the juddiv3 analyzer golden is regenerated with -update for that one purl. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…cveContentSourceLink and toVuls0Confidence The four solaris checks were one-off functions in a file of their own. They become rows of table tests in vendor_test.go, next to rows for the existing families (ubuntu / alpine / fortinet / microsoft / cpe), so each function has one test and the solaris rows read as coverage rather than an appendix. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
… the rebased PR heads Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
… the reviewed PR heads Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds Oracle Solaris as a family that vuls2 detects, on top of the
solarisecosystem and thesolaris-ipsRangeType from MaineK00n/vuls-data-update#959 (via MaineK00n/vuls2#440).Everything is a family- or ecosystem-keyed case next to the existing ones; the data itself comes from a vuls.db built with Solaris data, this PR adds no scanner support (
vuls scanstill does not know Solaris).Changes
constant.Solaris("solaris"), andGetCveContentTypesreturns the newsolarisCveContentType for it.models: CveContentTypesolarisand ConfidenceOracleSolarisAdvisoryMatch(score 100).detector/vuls2:advisoryReferencemaps a Solaris AdvisoryID (the public URL slug, e.g.bulletinjul2026/cpujul2026) tohttps://www.oracle.com/security-alerts/<slug>.html;toCveContentType/toVuls0Confidencecases keyed on thesolarisecosystem; a source link for the CveContentType. Thesolaris-ipsRangeType is compared throughaffectedrange.CompareVersionslikefreebsd-pkg; it is not a total order (a component absent on one side is skipped), so it is only ever used for the two-way installed-vs-bound check, noted infold.go.detector.DetectPkgCves:constant.Solarisjoins the families that go tovuls2.DetectPkgs(release + packages required; data-less or trivy results recorded / skipped like the others). Previously the family fell into theUnsupported detection methodsdefault.chore(deps): pins vuls2a218632→f77bd7f(chore(deps): bump vuls-data-update for solaris MaineK00n/vuls2#440 head) and vuls-data-update4b1dbcf→3c3958e(vuls/vuls:latest (>=0.9.2 db9efcc67b00) : json payload changed in response - notFixedYet field becomes optional #959 head).go mod tidyalso raisespackageurl-goto v0.1.7, which percent-encodes&in purl namespaces;scanner/testdata/golden/juddiv3-war-3.3.5.war.jsonis regenerated with-updatefor that one purl (R&D→R%26D).Draft until MaineK00n/vuls-data-update#959 and MaineK00n/vuls2#440 are merged: both pins are pseudo-versions of PR heads and will be re-pinned to the merge commits before this leaves draft.
Verification
GOWORK=off go build ./... && go vet ./... && go test ./...: passsolarisecosystem andsolaris-ipsRangeType, whichdetector/vuls2handles (check-enumscompares pinned vs nightly on its daily cron, not on PRs).Incoming
vuls2
a218632...f77bd7f(MaineK00n/vuls2):vuls-data-update
4b1dbcf...3c3958e(MaineK00n/vuls-data-update):-result-dirto be a S3 bucket and path for server and scan. #941)🤖 Generated with Claude Code