rhcc: handle known_not_affected without version comparison

For VEX "known_not_affected" assertions (vuln.Invert == true), the
package name match from the database query is sufficient. Version
comparison is skipped because:

1. The VEX assertion covers the entire container, not a specific version
2. The FixedInVersion field is empty for these assertions, which would
   cause rpmver.Parse to fail

Also adds a version Range to OCI PURL entries in the VEX parser to
ensure proper version matching semantics in the database query.

Signed-off-by: J. Victor Martins <jvdm@sdf.org>

Author: jvdm

rhel/rhcc/matcher.go

@@ -27,8 +27,7 @@ func (*matcher) Name() string { return "rhel-container-matcher" }
 
 // Filter implements [driver.Matcher].
 func (*matcher) Filter(r *claircore.IndexRecord) bool {
-	return r.Repository != nil &&
-		r.Repository.Key == RepositoryKey
+	return r.Repository != nil && r.Repository.Key == RepositoryKey
 }
 
 // Query implements [driver.Matcher].
@@ -52,6 +51,14 @@ func (*matcher) Vulnerable(ctx context.Context, record *claircore.IndexRecord, v
 	}
 
 	slog.DebugContext(ctx, "comparing versions", "record", record.Package.Version, "vulnerability", vuln.FixedInVersion)
+
+	// For known_not_affected assertions (Invert == true), the package name match
+	// from the DB query is sufficient. No version comparison is needed because the
+	// VEX assertion covers the entire container, not a specific version.
+	if vuln.Invert {
+		return true, nil
+	}
+
 	pkgVer, err := rpmver.Parse(record.Package.Version)
 	if err != nil {
 		return false, fmt.Errorf("rhcc: unable to parse version %q: %w", record.Package.Version, err)

rhel/rhcc/matcher_test.go

@@ -0,0 +1,71 @@
+package rhcc
+
+import (
+	"testing"
+
+	"github.com/quay/claircore"
+	"github.com/quay/claircore/test"
+)
+
+func TestMatcherVulnerable(t *testing.T) {
+	t.Parallel()
+	ctx := test.Logging(t)
+	m := &matcher{}
+
+	t.Run("Inverted", func(t *testing.T) {
+		record := &claircore.IndexRecord{
+			Package:    &claircore.Package{Name: "mta/mta-rhel8-operator", Version: "7.0.3-13"},
+			Repository: &GoldRepo,
+		}
+		vuln := &claircore.Vulnerability{
+			Name:   "CVE-2024-24786",
+			Invert: true,
+			Repo:   &GoldRepo,
+		}
+		got, err := m.Vulnerable(ctx, record, vuln)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if !got {
+			t.Error("expected vulnerable=true for inverted vulnerability")
+		}
+	})
+
+	t.Run("Normal", func(t *testing.T) {
+		record := &claircore.IndexRecord{
+			Package:    &claircore.Package{Name: "quay/quay-rhel8", Version: "v3.5.5-4"},
+			Repository: &GoldRepo,
+		}
+		vuln := &claircore.Vulnerability{
+			Name:           "CVE-2023-12345",
+			FixedInVersion: "v3.5.6-1",
+			Repo:           &GoldRepo,
+		}
+		got, err := m.Vulnerable(ctx, record, vuln)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if !got {
+			t.Error("expected vulnerable=true when version < fixed")
+		}
+	})
+
+	t.Run("Fixed", func(t *testing.T) {
+		record := &claircore.IndexRecord{
+			Package:    &claircore.Package{Name: "quay/quay-rhel8", Version: "v3.5.7-1"},
+			Repository: &GoldRepo,
+		}
+		vuln := &claircore.Vulnerability{
+			Name:           "CVE-2023-12345",
+			FixedInVersion: "v3.5.6-1",
+			Repo:           &GoldRepo,
+		}
+		got, err := m.Vulnerable(ctx, record, vuln)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if got {
+			t.Error("expected vulnerable=false when version >= fixed")
+		}
+	})
+}

rhel/vex/parser.go

@@ -980,6 +980,16 @@ func (c *creator) knownNotAffectedVulnerabilities(ctx context.Context, v *csaf.V
 			case packageurl.TypeOCI:
 				vuln.Repo = c.rc.Get(st.WFN, rhcc.RepositoryKey)
 				vuln.Package.Kind = types.AncestryPackage
+				// Use a flood-gates range that matches all versions. For
+				// known_not_affected assertions, the package name match is
+				// sufficient; the matcher skips version comparison when
+				// Invert is true.
+				vuln.Range = &claircore.Range{
+					Lower: new(rhctag.Version).Version(true),
+					Upper: (&rhctag.Version{
+						Major: math.MaxInt32,
+					}).Version(true),
+				}
 			default:
 				panic("unreachable")
 			}

rhel/vex/parser_test.go

@@ -357,10 +357,11 @@ func TestParse(t *testing.T) {
 	}
 
 	testcases := []struct {
-		name            string
-		filenames       []string
-		expectedVulns   int
-		expectedDeleted int
+		name             string
+		filenames        []string
+		expectedVulns    int
+		expectedDeleted  int
+		expectedAncestry int
 	}{
 		{
 			name: "five_advisories_four_deletions",
@@ -383,10 +384,11 @@ func TestParse(t *testing.T) {
 			expectedDeleted: 0,
 		},
 		{
-			name:            "cve-2024-24786",
-			filenames:       []string{"testdata/cve-2024-24786.json"},
-			expectedVulns:   1828,
-			expectedDeleted: 0,
+			name:             "cve-2024-24786",
+			filenames:        []string{"testdata/cve-2024-24786.json"},
+			expectedVulns:    1828,
+			expectedDeleted:  0,
+			expectedAncestry: 732,
 		},
 		{
 			name:            "cve-2022-38752",
@@ -462,6 +464,24 @@ func TestParse(t *testing.T) {
 			if len(deleted) != tc.expectedDeleted {
 				t.Fatalf("expected %d deleted but got %d", tc.expectedDeleted, len(deleted))
 			}
+			if tc.expectedAncestry > 0 {
+				var ancestryCount int
+				for _, v := range vulns {
+					if v.Package.Kind != types.AncestryPackage {
+						continue
+					}
+					ancestryCount++
+					if !v.Invert {
+						t.Errorf("ancestry vuln %q: expected Invert=true", v.Name)
+					}
+					if v.Range == nil {
+						t.Errorf("ancestry vuln %q: expected Range to be set", v.Name)
+					}
+				}
+				if ancestryCount != tc.expectedAncestry {
+					t.Errorf("expected %d ancestry vulns but got %d", tc.expectedAncestry, ancestryCount)
+				}
+			}
 		})
 	}
 }
@@ -666,3 +686,4 @@ func TestExtractPackageName(t *testing.T) {
 		})
 	}
 }
+