refactor(eol): added Alpine EOL dates to DB

pkg/db/db.go

@@ -7,6 +7,7 @@ import (
 	"path/filepath"
 	"runtime/debug"
 	"strings"
+	"time"
 
 	bolt "go.etcd.io/bbolt"
 	"golang.org/x/xerrors"
@@ -47,6 +48,10 @@ type Operation interface {
 
 	PutDataSource(tx *bolt.Tx, bktName string, source types.DataSource) (err error)
 
+	// EOL
+	PutEndOfLifeDates(tx *bolt.Tx, os string, dateList map[string]time.Time) (err error)
+	GetEndOfLifeDates(os string) (dateList map[string]time.Time, err error)
+
 	// For Red Hat
 	PutRedHatRepositories(tx *bolt.Tx, repository string, cpeIndices []int) (err error)
 	PutRedHatNVRs(tx *bolt.Tx, nvr string, cpeIndices []int) (err error)

pkg/db/eol.go

@@ -0,0 +1,26 @@
+package db
+
+import (
+	"encoding/json"
+	bolt "go.etcd.io/bbolt"
+	"golang.org/x/xerrors"
+	"time"
+)
+
+const eofBucket = "eol"
+
+func (dbc Config) PutEndOfLifeDates(tx *bolt.Tx, os string, dateList map[string]time.Time) error {
+	if err := dbc.put(tx, []string{eofBucket}, os, dateList); err != nil {
+		return xerrors.Errorf("failed to put list of end-of-life dates: %w", err)
+	}
+	return nil
+}
+
+func (dbc Config) GetEndOfLifeDates(os string) (dateList map[string]time.Time, err error) {
+	value, err := dbc.get([]string{eofBucket}, os)
+	if err = json.Unmarshal(value, &dateList); err != nil {
+		return make(map[string]time.Time), xerrors.Errorf("failed to get list of end-of-life dates for %q: %w", os, err)
+	}
+
+	return dateList, nil
+}

pkg/db/eol_test.go

@@ -0,0 +1,54 @@
+package db_test
+
+import (
+	"github.com/aquasecurity/trivy-db/pkg/db"
+	"github.com/aquasecurity/trivy-db/pkg/dbtest"
+	"github.com/stretchr/testify/assert"
+	"testing"
+	"time"
+)
+
+func TestConfig_GetEndOfLifeDates(t *testing.T) {
+	tests := []struct {
+		name     string
+		fixtures []string
+		os       string
+		want     map[string]time.Time
+		wantErr  string
+	}{
+		{
+			name:     "happy path",
+			os:       "alpine",
+			fixtures: []string{"testdata/fixtures/eol.yaml"},
+			want: map[string]time.Time{
+				"3.14": time.Date(2023, 5, 1, 23, 59, 59, 0, time.UTC),
+				"3.15": time.Date(2023, 11, 1, 23, 59, 59, 0, time.UTC),
+				"edge": time.Date(9999, 1, 1, 0, 0, 0, 0, time.UTC),
+			},
+		},
+		{
+			name:     "missing OS",
+			os:       "unknown",
+			fixtures: []string{"testdata/fixtures/eol.yaml"},
+			wantErr:  `failed to get list of end-of-life dates for "unknown"`,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			// Initialize DB
+			dbtest.InitDB(t, test.fixtures)
+			defer db.Close()
+
+			dbc := db.Config{}
+			got, err := dbc.GetEndOfLifeDates(test.os)
+
+			if test.wantErr != "" {
+				assert.NotNil(t, err)
+				assert.Contains(t, err.Error(), test.wantErr)
+			} else {
+				assert.Nil(t, err)
+				assert.Equal(t, test.want, got)
+			}
+		})
+	}
+}

pkg/db/testdata/fixtures/eol.yaml

@@ -0,0 +1,7 @@
+- bucket: eol
+  pairs:
+    - key: alpine
+      value:
+        3.14: "2023-05-01T23:59:59Z"
+        3.15: "2023-11-01T23:59:59Z"
+        edge: "9999-01-01T00:00:00Z"

pkg/vulnsrc/eol/alpine/alpine.go

@@ -0,0 +1,73 @@
+package alpine
+
+import (
+	"encoding/json"
+	"log"
+	"os"
+	"path/filepath"
+	"time"
+
+	"github.com/aquasecurity/trivy-db/pkg/db"
+	"github.com/aquasecurity/trivy-db/pkg/types"
+	"github.com/aquasecurity/trivy-db/pkg/vulnsrc/vulnerability"
+	bolt "go.etcd.io/bbolt"
+	"golang.org/x/xerrors"
+)
+
+const (
+	osName  = "alpine"
+	eolDir  = "eol"
+	eolFile = "alpine.json"
+)
+
+type EolSrc struct {
+	dbc db.Operation
+}
+
+func NewEolSrc() EolSrc {
+	return EolSrc{
+		dbc: db.Config{},
+	}
+}
+
+func (es EolSrc) Name() types.SourceID {
+	return vulnerability.AlpineEOL
+}
+
+func (es EolSrc) Update(dir string) (err error) {
+	rootFilePath := filepath.Join(dir, "vuln-list", eolDir, osName, eolFile)
+	var eolDates map[string]time.Time
+
+	f, err := os.ReadFile(rootFilePath)
+	if err != nil {
+		return xerrors.Errorf("failed to open %q file", rootFilePath)
+	}
+
+	if err := json.Unmarshal(f, &eolDates); err != nil {
+		return xerrors.Errorf("failed to decode list of end-of-life dates: %w", err)
+	}
+
+	return es.save(eolDates)
+}
+
+func (es EolSrc) save(eolDates map[string]time.Time) error {
+	log.Println("Alpine EOL dates batch update")
+	err := es.dbc.BatchUpdate(func(tx *bolt.Tx) error {
+		return es.commit(tx, eolDates)
+	})
+	if err != nil {
+		return xerrors.Errorf("error in batch update: %w", err)
+	}
+	return nil
+}
+
+func (es EolSrc) commit(tx *bolt.Tx, eolDates map[string]time.Time) error {
+	if err := es.dbc.PutEndOfLifeDates(tx, osName, eolDates); err != nil {
+		return xerrors.Errorf("failed to save Alpine EOL dates: %w", err)
+	}
+	return nil
+}
+
+func (es EolSrc) GetEolDates(osName string) (map[string]time.Time, error) {
+	return es.dbc.GetEndOfLifeDates(osName)
+}

pkg/vulnsrc/eol/alpine/alpine_test.go

@@ -0,0 +1,48 @@
+package alpine
+
+import (
+	"github.com/aquasecurity/trivy-db/pkg/vulnsrctest"
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+func TestEolSrc_Update(t *testing.T) {
+	tests := []struct {
+		name       string
+		dir        string
+		wantValues []vulnsrctest.WantValues
+		wantErr    string
+	}{
+		{
+			name: "happy path",
+			dir:  filepath.Join("testdata", "happy"),
+			wantValues: []vulnsrctest.WantValues{
+				{
+					Key: []string{"eol", "alpine"},
+					Value: map[string]time.Time{
+						"3.14": time.Date(2023, 5, 1, 23, 59, 59, 0, time.UTC),
+						"3.15": time.Date(2023, 11, 1, 23, 59, 59, 0, time.UTC),
+						"edge": time.Date(9999, 1, 1, 0, 0, 0, 0, time.UTC),
+					},
+				},
+			},
+		},
+		{
+			name:    "sad path",
+			dir:     filepath.Join("testdata", "sad"),
+			wantErr: "failed to decode list of end-of-life dates",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			es := NewEolSrc()
+			vulnsrctest.TestUpdate(t, es, vulnsrctest.TestUpdateArgs{
+				Dir:        test.dir,
+				WantValues: test.wantValues,
+				WantErr:    test.wantErr,
+			})
+		})
+	}
+}

pkg/vulnsrc/eol/alpine/testdata/happy/vuln-list/eol/alpine/alpine.json

@@ -0,0 +1,5 @@
+{
+  "3.14": "2023-05-01T23:59:59Z",
+  "3.15": "2023-11-01T23:59:59Z",
+  "edge": "9999-01-01T00:00:00Z"
+}

pkg/vulnsrc/eol/alpine/testdata/sad/vuln-list/eol/alpine/alpine.json

@@ -0,0 +1,4 @@
+{
+  "3.14": "2023-05-01T23:59:59Z",
+  "3.15": "2023-11-01T23:59:59Z",
+  "edge": "9999-01-01T00:00:00Z",

pkg/vulnsrc/vulnerability/const.go

@@ -28,6 +28,9 @@ const (
 	GoVulnDB              types.SourceID = "go-vulndb"
 	OSV                   types.SourceID = "osv"
 
+	// End-of-life dates
+	AlpineEOL types.SourceID = "alpine-eol"
+
 	// Ecosystem
 	Npm      types.Ecosystem = "npm"
 	Composer types.Ecosystem = "composer"

pkg/vulnsrc/vulnsrc.go

@@ -9,6 +9,7 @@ import (
 	"github.com/aquasecurity/trivy-db/pkg/vulnsrc/bundler"
 	"github.com/aquasecurity/trivy-db/pkg/vulnsrc/composer"
 	"github.com/aquasecurity/trivy-db/pkg/vulnsrc/debian"
+	eolalpine "github.com/aquasecurity/trivy-db/pkg/vulnsrc/eol/alpine"
 	"github.com/aquasecurity/trivy-db/pkg/vulnsrc/ghsa"
 	"github.com/aquasecurity/trivy-db/pkg/vulnsrc/glad"
 	"github.com/aquasecurity/trivy-db/pkg/vulnsrc/govulndb"
@@ -60,5 +61,8 @@ var (
 		glad.NewVulnSrc(),
 		govulndb.NewVulnSrc(),
 		osv.NewVulnSrc(),
+
+		// End-of-life dates
+		eolalpine.NewEolSrc(),
 	}
 )