fix(alpine): save not only CVE-IDs

pkg/vulnsrc/alpine/alpine.go

@@ -97,20 +97,32 @@ func (vs VulnSrc) saveSecFixes(tx *bolt.Tx, platform, pkgName string, secfixes m
 		for _, vulnID := range vulnIDs {
 			// See https://gitlab.alpinelinux.org/alpine/infra/docker/secdb/-/issues/3
 			// e.g. CVE-2017-2616 (+ regression fix)
+			// e.g. GHSA-h6cc-rc6q-23j4 (+regression fix)
 			ids := strings.Fields(vulnID)
-			for _, cveID := range ids {
-				cveID = strings.ReplaceAll(cveID, "CVE_", "CVE-")
-				if !strings.HasPrefix(cveID, "CVE-") {
-					continue
-				}
-				if err := vs.dbc.PutAdvisoryDetail(tx, cveID, pkgName, []string{platform}, advisory); err != nil {
-					return oops.Wrapf(err, "failed to save advisory")
+			// Find CVE-ID first, if not found, use GHSA-ID
+			var selectedID string
+			for _, id := range ids {
+				id = strings.ReplaceAll(id, "CVE_", "CVE-")
+				if strings.HasPrefix(id, "CVE-") {
+					selectedID = id
+					break // CVE-ID found, prioritize it
+				} else if strings.HasPrefix(id, "GHSA-") {
+					selectedID = id // Use GHSA-ID if no CVE-ID found yet
 				}
+			}
 
-				// for optimization
-				if err := vs.dbc.PutVulnerabilityID(tx, cveID); err != nil {
-					return oops.Wrapf(err, "failed to save the vulnerability ID")
-				}
+			if selectedID == "" {
+				// No valid vulnerability ID found
+				continue
+			}
+
+			if err := vs.dbc.PutAdvisoryDetail(tx, selectedID, pkgName, []string{platform}, advisory); err != nil {
+				return oops.Wrapf(err, "failed to save advisory")
+			}
+
+			// for optimization
+			if err := vs.dbc.PutVulnerabilityID(tx, selectedID); err != nil {
+				return oops.Wrapf(err, "failed to save the vulnerability ID")
 			}
 		}
 	}

pkg/vulnsrc/alpine/alpine_test.go

@@ -41,12 +41,85 @@ func TestVulnSrc_Update(t *testing.T) {
 						FixedVersion: "2.9.3-r0",
 					},
 				},
+				{
+					Key: []string{"advisory-detail", "CVE-2024-22195", "alpine 3.12", "ansible"},
+					Value: types.Advisory{
+						FixedVersion: "2.9.3-r0",
+					},
+				},
+				{
+					Key: []string{"advisory-detail", "CVE-2017-2616", "alpine 3.12", "ansible"},
+					Value: types.Advisory{
+						FixedVersion: "2.9.3-r0",
+					},
+				},
+				{
+					Key: []string{"advisory-detail", "GHSA-f7r5-w49x-gxm3", "alpine 3.12", "ansible"},
+					Value: types.Advisory{
+						FixedVersion: "2.9.3-r0",
+					},
+				},
+				{
+					Key: []string{"advisory-detail", "GHSA-h6cc-rc6q-23j4", "alpine 3.12", "ansible"},
+					Value: types.Advisory{
+						FixedVersion: "2.9.3-r0",
+					},
+				},
 				{
 					Key: []string{"advisory-detail", "CVE-2020-1737", "alpine 3.12", "ansible"},
 					Value: types.Advisory{
 						FixedVersion: "2.9.6-r0",
 					},
 				},
+				{
+					Key: []string{
+						"vulnerability-id",
+						"CVE-2019-14904",
+					},
+					Value: map[string]interface{}{},
+				},
+				{
+					Key: []string{
+						"vulnerability-id",
+						"CVE-2019-14905",
+					},
+					Value: map[string]interface{}{},
+				},
+				{
+					Key: []string{
+						"vulnerability-id",
+						"CVE-2024-22195",
+					},
+					Value: map[string]interface{}{},
+				},
+				{
+					Key: []string{
+						"vulnerability-id",
+						"CVE-2017-2616",
+					},
+					Value: map[string]interface{}{},
+				},
+				{
+					Key: []string{
+						"vulnerability-id",
+						"GHSA-f7r5-w49x-gxm3",
+					},
+					Value: map[string]interface{}{},
+				},
+				{
+					Key: []string{
+						"vulnerability-id",
+						"GHSA-h6cc-rc6q-23j4",
+					},
+					Value: map[string]interface{}{},
+				},
+				{
+					Key: []string{
+						"vulnerability-id",
+						"CVE-2020-1737",
+					},
+					Value: map[string]interface{}{},
+				},
 			},
 		},
 		{

pkg/vulnsrc/alpine/testdata/happy/vuln-list/alpine/ansible.json

@@ -3,7 +3,11 @@
   "secfixes": {
     "2.9.3-r0": [
       "CVE-2019-14904",
-      "CVE-2019-14905"
+      "CVE-2019-14905",
+      "CVE-2024-22195 GHSA-h5c8-rqwp-cp95",
+      "CVE-2017-2616 (+ regression fix)",
+      "GHSA-f7r5-w49x-gxm3",
+      "GHSA-h6cc-rc6q-23j4 (+regression fix)"
     ],
     "2.9.6-r0": [
       "CVE-2020-1737"