feat(vex): synthesize matches from SBOM for affected VEX statements

Previously, AugmentMatches could only promote a vulnerability that grype's
DB had already found and that another rule had filtered into the ignored
list. When the DB had no record of a (vulnerability, package) pair, an
"affected" VEX statement naming that package was silently ignored, even
though the statement is the strongest possible claim that the package is
vulnerable. This left a visible gap versus tools like govulncheck, which
report findings the grype DB simply does not carry.

This change lets VEX `affected` / `under_investigation` statements
synthesize a finding directly from the SBOM:

  * The vexProcessorImplementation interface and ApplyVEX now receive the
    package catalog, plumbed through findVEXMatches in the vulnerability
    matcher.
  * OpenVEX: after the existing ignored-match loop, walk the catalog and
    add a match for each statement that names a package by purl. Version
    matching is exact (or wildcard when the statement omits a version),
    matching the OpenVEX spec — no implicit ranges.
  * CSAF: same synthesis loop, but with status-aware version semantics
    that follow the CSAF spec:
      - last_affected   → pkg.version <= stmt.version  (ceiling)
      - first_affected  → pkg.version >= stmt.version  (floor)
      - known_affected / recommended / under_investigation → exact
      - fixed / known_not_affected → never synthesize
    Comparisons use grype/version with pkg.VersionFormat, so they are
    ecosystem-aware (semver, deb, rpm, apk, go-module, etc.). Statement
    qualifiers must be a subset of the package's qualifiers; type,
    namespace and name must match exactly.

Dedup: synthesis keys on (vulnerability ID, package purl) and skips any
pair already present in the remaining or ignored match sets, so the new
path never duplicates a DB-backed finding.

Behavior is gated by the existing VEX configuration: users still need
`vex-add: [affected, under_investigation]` plus a matching ignore rule
for the synthesized matches to surface, so default scans are unchanged.

Tests:
  * grype/vex/openvex/implementation_test.go covers exact-match
    synthesis, status filtering, purl mismatch, empty catalog,
    ignore-rule vulnerability filtering, and dedup against existing
    matches.
  * grype/vex/csaf/implementation_test.go adds TestPackageMatchesStatement
    (16 cases for ceiling/floor/exact/wildcard + identity mismatches),
    TestAugmentMatches_SynthesizesFromPackageCatalog (9 cases per status
    against lower/equal/higher SBOM versions), and a dedup test.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: xnox

grype/vex/csaf/csaf.go

@@ -4,6 +4,10 @@ import (
 	"slices"
 
 	"github.com/gocsaf/csaf/v3/csaf"
+
+	"github.com/anchore/grype/grype/pkg"
+	"github.com/anchore/grype/grype/version"
+	"github.com/anchore/packageurl-go"
 )
 
 // advisoryMatch captures the criteria that caused a vulnerability to match a CSAF advisory
@@ -127,3 +131,157 @@ func purlsFromProductIdentificationHelpers(helpers []*csaf.ProductIdentification
 	}
 	return purls
 }
+
+// synthesisCandidate describes a (vulnerability, package) pair that should be
+// added to grype's results based on a CSAF advisory, when no DB-backed match
+// already exists.
+type synthesisCandidate struct {
+	Vulnerability *csaf.Vulnerability
+	Status        status
+	ProductID     csaf.ProductID
+	Package       *pkg.Package
+}
+
+// findSynthesisCandidates walks every advisory and yields (vuln, package)
+// pairs eligible for synthesis. Range semantics are applied per status:
+//   - last_affected: pkg.version <= stmt.version (ceiling)
+//   - first_affected: pkg.version >= stmt.version (floor)
+//   - known_affected, recommended, under_investigation: exact match
+//     (or wildcard if the statement purl has no version)
+//
+// Statuses that are not "affected-like" (fixed, known_not_affected) never
+// trigger synthesis.
+//
+//nolint:gocognit
+func (advisories advisories) findSynthesisCandidates(pkgs []pkg.Package) []synthesisCandidate {
+	var out []synthesisCandidate
+	if len(pkgs) == 0 {
+		return out
+	}
+
+	for _, adv := range advisories {
+		if adv == nil || adv.Vulnerabilities == nil {
+			continue
+		}
+
+		for _, vuln := range adv.Vulnerabilities {
+			if vuln == nil || vuln.CVE == nil {
+				continue
+			}
+
+			productsByStatus := map[status]*csaf.Products{
+				firstAffected:      vuln.ProductStatus.FirstAffected,
+				knownAffected:      vuln.ProductStatus.KnownAffected,
+				lastAffected:       vuln.ProductStatus.LastAffected,
+				recommended:        vuln.ProductStatus.Recommended,
+				underInvestigation: vuln.ProductStatus.UnderInvestigation,
+			}
+
+			for st, products := range productsByStatus {
+				if products == nil {
+					continue
+				}
+				for _, productIDPtr := range *products {
+					if productIDPtr == nil {
+						continue
+					}
+					productID := *productIDPtr
+					helpers := adv.ProductTree.CollectProductIdentificationHelpers(productID)
+					for _, stmtPURL := range purlsFromProductIdentificationHelpers(helpers) {
+						for i := range pkgs {
+							p := &pkgs[i]
+							if p.PURL == "" {
+								continue
+							}
+							if !packageMatchesStatement(stmtPURL, p, st) {
+								continue
+							}
+							out = append(out, synthesisCandidate{
+								Vulnerability: vuln,
+								Status:        st,
+								ProductID:     productID,
+								Package:       p,
+							})
+						}
+					}
+				}
+			}
+		}
+	}
+
+	return out
+}
+
+// packageMatchesStatement reports whether the given package's purl falls
+// within the scope of a VEX statement that names stmtPURL with the given
+// CSAF status. Type/namespace/name/qualifiers must always match; the version
+// dimension is interpreted according to the status.
+func packageMatchesStatement(stmtPURL string, p *pkg.Package, st status) bool {
+	stmt, err := packageurl.FromString(stmtPURL)
+	if err != nil {
+		return false
+	}
+	pkgPURL, err := packageurl.FromString(p.PURL)
+	if err != nil {
+		return false
+	}
+
+	if stmt.Type != pkgPURL.Type || stmt.Namespace != pkgPURL.Namespace || stmt.Name != pkgPURL.Name {
+		return false
+	}
+	if !qualifierSubset(stmt.Qualifiers, pkgPURL.Qualifiers) {
+		return false
+	}
+
+	// No version in the statement -> wildcard, matches any pkg version.
+	if stmt.Version == "" {
+		return true
+	}
+	if pkgPURL.Version == "" {
+		// Statement is version-specific but the package's purl has none.
+		return false
+	}
+
+	format := pkg.VersionFormat(*p)
+
+	switch st {
+	case lastAffected:
+		return compareVersions(pkgPURL.Version, stmt.Version, format, version.LTE)
+	case firstAffected:
+		return compareVersions(pkgPURL.Version, stmt.Version, format, version.GTE)
+	default:
+		// knownAffected, recommended, underInvestigation: exact match.
+		return stmt.Version == pkgPURL.Version
+	}
+}
+
+func compareVersions(pkgVersion, stmtVersion string, format version.Format, op version.Operator) bool {
+	pkgV := version.New(pkgVersion, format)
+	stmtV := version.New(stmtVersion, format)
+	ok, err := pkgV.Is(op, stmtV)
+	if err != nil {
+		return false
+	}
+	return ok
+}
+
+func qualifierSubset(stmtQ, pkgQ packageurl.Qualifiers) bool {
+	pkgMap := pkgQ.Map()
+	for _, sq := range stmtQ {
+		if v, ok := pkgMap[sq.Key]; !ok || v != sq.Value {
+			return false
+		}
+	}
+	return true
+}
+
+// toAdvisoryMatch returns the advisoryMatch shape expected by the rest of the
+// CSAF code (so a synthesis candidate plugs into matchingRule, statement(),
+// etc.).
+func (c synthesisCandidate) toAdvisoryMatch() *advisoryMatch {
+	return &advisoryMatch{
+		Vulnerability: c.Vulnerability,
+		Status:        c.Status,
+		ProductID:     c.ProductID,
+	}
+}

grype/vex/csaf/implementation.go

@@ -11,6 +11,7 @@ import (
 	"github.com/anchore/grype/grype/match"
 	"github.com/anchore/grype/grype/pkg"
 	vexStatus "github.com/anchore/grype/grype/vex/status"
+	"github.com/anchore/grype/grype/vulnerability"
 )
 
 // searchedBy captures the parameters used to search through the VEX data
@@ -121,9 +122,13 @@ func (*Processor) FilterMatches(
 
 // AugmentMatches adds results to the match.Matches array when matching data
 // about an affected VEX product is found on loaded VEX documents. Matches
-// are moved from the ignore list back to active matches.
+// are moved from the ignore list back to active matches, or synthesized from
+// the package catalog when the vulnerability database has no record of the
+// affected (vulnerability, package) pair. last_affected and first_affected
+// statuses are interpreted as version range bounds; other affected-like
+// statuses use exact version match.
 func (*Processor) AugmentMatches(
-	docRaw any, ignoreRules []match.IgnoreRule, _ *pkg.Context, matches *match.Matches, ignoredMatches []match.IgnoredMatch,
+	docRaw any, ignoreRules []match.IgnoreRule, _ *pkg.Context, pkgs []pkg.Package, matches *match.Matches, ignoredMatches []match.IgnoredMatch,
 ) (*match.Matches, []match.IgnoredMatch, error) {
 	advisories, ok := docRaw.(advisories)
 	if !ok {
@@ -152,9 +157,86 @@ func (*Processor) AugmentMatches(
 		remainingIgnoredMatches = append(remainingIgnoredMatches, m)
 	}
 
+	synthesizeFromCatalog(advisories, ignoreRules, pkgs, matches, remainingIgnoredMatches)
+
 	return matches, remainingIgnoredMatches, nil
 }
 
+// synthesizeFromCatalog walks the package catalog and creates new matches for
+// any (vulnerability, package) pair named as affected (or under_investigation)
+// in the loaded CSAF advisories that is not already represented in the
+// remaining or ignored match sets.
+func synthesizeFromCatalog(
+	advs advisories,
+	ignoreRules []match.IgnoreRule,
+	pkgs []pkg.Package,
+	remainingMatches *match.Matches,
+	ignoredMatches []match.IgnoredMatch,
+) {
+	candidates := advs.findSynthesisCandidates(pkgs)
+	if len(candidates) == 0 {
+		return
+	}
+
+	known := existingVulnPackageKeys(remainingMatches, ignoredMatches)
+
+	for _, c := range candidates {
+		advMatch := c.toAdvisoryMatch()
+		vulnID := advMatch.cve()
+		if vulnID == "" {
+			continue
+		}
+		key := vulnPackageKey(vulnID, c.Package.PURL)
+		if _, seen := known[key]; seen {
+			continue
+		}
+
+		synthesized := match.Match{
+			Vulnerability: vulnerability.Vulnerability{
+				Reference: vulnerability.Reference{
+					ID:        vulnID,
+					Namespace: "vex",
+				},
+			},
+			Package: *c.Package,
+		}
+		if rule := matchingRule(ignoreRules, synthesized, advMatch, vexStatus.AugmentList()); rule == nil {
+			continue
+		}
+
+		synthesized.Details = []match.Detail{
+			{
+				Type: match.ExactDirectMatch,
+				SearchedBy: &searchedBy{
+					Vulnerability: vulnID,
+					Purl:          c.Package.PURL,
+				},
+				Found:      advMatch,
+				Matcher:    match.CsafVexMatcher,
+				Confidence: 1,
+			},
+		}
+
+		remainingMatches.Add(synthesized)
+		known[key] = struct{}{}
+	}
+}
+
+func existingVulnPackageKeys(remainingMatches *match.Matches, ignoredMatches []match.IgnoredMatch) map[string]struct{} {
+	known := map[string]struct{}{}
+	for _, m := range remainingMatches.Sorted() {
+		known[vulnPackageKey(m.Vulnerability.ID, m.Package.PURL)] = struct{}{}
+	}
+	for _, m := range ignoredMatches {
+		known[vulnPackageKey(m.Vulnerability.ID, m.Package.PURL)] = struct{}{}
+	}
+	return known
+}
+
+func vulnPackageKey(vulnID, purl string) string {
+	return vulnID + "\x00" + purl
+}
+
 // matchingRule cycles through a set of ignore rules and returns the first
 // one that matches the statement and the match. Returns nil if none match.
 func matchingRule(ignoreRules []match.IgnoreRule, m match.Match, advMatch *advisoryMatch, allowedStatuses []vexStatus.Status) *match.IgnoreRule {