Updates to scanner with CVE saving and auto update

PHPGuard/SSHScanner.swift

@@ -172,27 +172,44 @@ enum SSHScanner {
     case "$package_manager" in
       apt)
         if command -v apt-cache >/dev/null 2>&1; then
-          dpkg-query -W -f='${Package}\n' 'php*' \
-            2>/dev/null |
-          grep -E '^php[0-9.-]*([a-z-]+)?$' |
-          sort -u |
-          while IFS= read -r pkg; do
-            [ -n "$pkg" ] || continue
+          dpkg-query -W \
+            -f='${db:Status-Abbrev}|${binary:Package}|${Version}\n' \
+            'php*' 2>/dev/null |
+          while IFS='|' read -r state pkg installed; do
+            case "$state" in ii*) ;; *) continue ;; esac
+            case "$pkg" in php*) ;; *) continue ;; esac
+            [ -n "$installed" ] || continue
 
-            installed=$(dpkg-query -W -f='${Version}' \
-              "$pkg" 2>/dev/null || true)
+            policy=$(apt-cache policy "$pkg" 2>/dev/null || true)
 
-            candidate=$(apt-cache policy "$pkg" 2>/dev/null |
+            candidate=$(printf '%s\n' "$policy" |
               sed -n 's/^[[:space:]]*Candidate: //p' |
               head -1)
 
             printf '%s installed=%s candidate=%s\n' \
               "$pkg" "$installed" "${candidate:-unknown}"
 
-            apt-cache policy "$pkg" 2>/dev/null |
-              grep -E 'https?://|/ubuntu |/ubuntu$' |
-              head -3 |
-              sed 's/^[[:space:]]*/  /'
+            # Repository matching is informational, not an attestation.
+            # Match the exact installed version and its repository entries.
+            printf '%s\n' "$policy" |
+              awk -v installed="$installed" -v pkg="$pkg" '
+                /^[[:space:]]*(\*\*\*[[:space:]]*)?[^[:space:]]+[[:space:]]+[0-9]+$/ {
+                  version=$1
+                  if (version=="***") version=$2
+                  matching=(version==installed)
+                  next
+                }
+
+                matching && /https?:\/\// {
+                  if ($0 ~ /archive[.]ubuntu[.]com\/ubuntu/ ||
+                      $0 ~ /security[.]ubuntu[.]com\/ubuntu/) {
+                    print "UBUNTU_REPOSITORY_MATCH|" pkg "|" installed
+                    matching=0
+                  } else {
+                    print "OTHER_REPOSITORY_MATCH|" pkg "|" installed
+                  }
+                }
+              '
           done
         else
           printf 'APT metadata unavailable\n'