Updates to scanner with CVE saving and auto update

2026-10-22 17:56:13 +01:00
parent d8878737fd
commit ee37674a2a
9 changed files with 106 additions and 22 deletions
@@ -0,0 +1,22 @@
+# PHPGuard security assessment readiness
+
+## Status: not production-validated
+
+The scan collects package inventory and upstream NVD PHP CVE *candidates*. A version match, lack of upgrades, or an available upgrade does not establish exposure or remediation.
+
+### Verified statuses
+
+- `Unverified` is the default for unsupported distribution/vendor combinations, unknown package provenance, absent advisories, and network failures.
+- Ubuntu's existing advisory adapter is intentionally **fail closed** until installed package provenance is independently proven at the installed-version level. Seeing an Ubuntu repository in APT policy is insufficient: the installed package may be from a PPA or custom build.
+- Docker PHP is not covered by host package advisories.
+- NVD discovery is bounded and may omit CVEs; no-results is not a clean security bill.
+
+### Before production release
+
+1. Implement per-installed-version repository origin verification and test Ubuntu advisory response parsing against current fixtures.
+2. Implement and test Debian, Red Hat-family, SUSE, Amazon Linux and Alpine advisory adapters using official vendor data and native package version comparison.
+3. Add test fixtures for package manager outputs, package origin edge cases, CVE states, missing metadata, errors, and containers.
+4. Run integration tests on each supported distribution with minimal and restricted SSH permissions.
+5. Run Xcode build, UI checks, signing and notarization on macOS; this archive has not been built in Xcode here.
+
+This package is a security-hardening development snapshot, **not a production release**.