feat(vuln): scanner service and fixture-driven L1 tests

Stdlib-only scanner per docs/17: Kubernetes API inventory, Trivy runner, persisted state, schema-validated report.json, strict acceptances parser, server-rendered page, aggregate metrics, internal API, and a scan loop that stays live while scanning. L1 tests under conformance/tests/l1-rendering/vuln-scanner-* run the actual modules against recorded fixtures with a fake Trivy runner. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-11-09 09:41:23 -06:00
1 parent 4c3a284cad
commit 50ec2297ee
@@ -0,0 +1,198 @@
+{
+ "cronjobs": [
+  {
+   "metadata": {
+    "name": "nightly",
+    "namespace": "ops"
+   },
+   "spec": {
+    "jobTemplate": {
+     "spec": {
+      "template": {
+       "spec": {
+        "containers": [
+         {
+          "image": "ghcr.io/org/nightly:2.1",
+          "name": "job"
+         }
+        ]
+       }
+      }
+     }
+    }
+   }
+  }
+ ],
+ "jobs": [],
+ "nodes": [
+  {
+   "metadata": {
+    "name": "prod-1"
+   }
+  }
+ ],
+ "pods": [
+  {
+   "metadata": {
+    "name": "web-1",
+    "namespace": "apps",
+    "ownerReferences": [
+     {
+      "controller": true,
+      "kind": "ReplicaSet",
+      "name": "web-5f"
+     }
+    ]
+   },
+   "spec": {
+    "containers": [
+     {
+      "image": "nginx:1.27",
+      "name": "app"
+     }
+    ]
+   },
+   "status": {
+    "containerStatuses": [
+     {
+      "imageID": "docker.io/library/nginx@sha256:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
+      "name": "app"
+     }
+    ],
+    "phase": "Running"
+   }
+  },
+  {
+   "metadata": {
+    "name": "api-1",
+    "namespace": "apps",
+    "ownerReferences": [
+     {
+      "controller": true,
+      "kind": "ReplicaSet",
+      "name": "api-77"
+     }
+    ]
+   },
+   "spec": {
+    "containers": [
+     {
+      "image": "nginx:1.27",
+      "name": "server"
+     }
+    ]
+   },
+   "status": {
+    "containerStatuses": [
+     {
+      "imageID": "docker.io/library/nginx@sha256:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
+      "name": "server"
+     }
+    ],
+    "phase": "Running"
+   }
+  },
+  {
+   "metadata": {
+    "name": "db-0",
+    "namespace": "data",
+    "ownerReferences": [
+     {
+      "controller": true,
+      "kind": "StatefulSet",
+      "name": "db"
+     }
+    ]
+   },
+   "spec": {
+    "containers": [
+     {
+      "image": "postgres:16",
+      "name": "postgres"
+     }
+    ]
+   },
+   "status": {
+    "containerStatuses": [
+     {
+      "imageID": "docker.io/library/postgres@sha256:d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4d4",
+      "name": "postgres"
+     }
+    ],
+    "phase": "Running"
+   }
+  },
+  {
+   "metadata": {
+    "name": "priv-1",
+    "namespace": "apps",
+    "ownerReferences": [
+     {
+      "controller": true,
+      "kind": "ReplicaSet",
+      "name": "priv-1a"
+     }
+    ]
+   },
+   "spec": {
+    "containers": [
+     {
+      "image": "ghcr.io/org/private:1",
+      "name": "priv"
+     }
+    ]
+   },
+   "status": {
+    "containerStatuses": [
+     {
+      "imageID": "ghcr.io/org/private@sha256:e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5",
+      "name": "priv"
+     }
+    ],
+    "phase": "Running"
+   }
+  }
+ ],
+ "replicasets": [
+  {
+   "metadata": {
+    "name": "web-5f",
+    "namespace": "apps",
+    "ownerReferences": [
+     {
+      "controller": true,
+      "kind": "Deployment",
+      "name": "web"
+     }
+    ]
+   }
+  },
+  {
+   "metadata": {
+    "name": "api-77",
+    "namespace": "apps",
+    "ownerReferences": [
+     {
+      "controller": true,
+      "kind": "Deployment",
+      "name": "api"
+     }
+    ]
+   }
+  },
+  {
+   "metadata": {
+    "name": "priv-1a",
+    "namespace": "apps",
+    "ownerReferences": [
+     {
+      "controller": true,
+      "kind": "Deployment",
+      "name": "priv"
+     }
+    ]
+   }
+  }
+ ],
+ "vmis": []
+}
@@ -0,0 +1,4 @@
+{
+ "ArtifactName": "x",
+ "SchemaVersion": 2
+}
@@ -0,0 +1,33 @@
+{
+ "ArtifactName": "x",
+ "Results": [
+  {
+   "Target": "t",
+   "Vulnerabilities": [
+    {
+     "CVSS": {
+      "nvd": {
+       "V3Score": 9.8
+      }
+     },
+     "FixedVersion": "3.0.2",
+     "InstalledVersion": "1.0",
+     "PkgName": "openssl",
+     "PrimaryURL": "https://example.test/CVE-2026-0001",
+     "Severity": "CRITICAL",
+     "Title": "OpenSSL flaw",
+     "VulnerabilityID": "CVE-2026-0001"
+    },
+    {
+     "InstalledVersion": "1.0",
+     "PkgName": "zlib",
+     "PrimaryURL": "https://example.test/CVE-2026-0002",
+     "Severity": "LOW",
+     "Title": "t",
+     "VulnerabilityID": "CVE-2026-0002"
+    }
+   ]
+  }
+ ],
+ "SchemaVersion": 2
+}
@@ -0,0 +1,19 @@
+{
+ "ArtifactName": "x",
+ "Results": [
+  {
+   "Target": "t",
+   "Vulnerabilities": [
+    {
+     "InstalledVersion": "1.0",
+     "PkgName": "curl",
+     "PrimaryURL": "https://example.test/CVE-2026-0020",
+     "Severity": "MEDIUM",
+     "Title": "t",
+     "VulnerabilityID": "CVE-2026-0020"
+    }
+   ]
+  }
+ ],
+ "SchemaVersion": 2
+}
@@ -0,0 +1,25 @@
+{
+ "ArtifactName": "x",
+ "Results": [
+  {
+   "Target": "t",
+   "Vulnerabilities": [
+    {
+     "CVSS": {
+      "nvd": {
+       "V3Score": 7.5
+      }
+     },
+     "FixedVersion": "16.2",
+     "InstalledVersion": "1.0",
+     "PkgName": "libpq",
+     "PrimaryURL": "https://example.test/CVE-2026-0010",
+     "Severity": "HIGH",
+     "Title": "libpq flaw",
+     "VulnerabilityID": "CVE-2026-0010"
+    }
+   ]
+  }
+ ],
+ "SchemaVersion": 2
+}