From ff193aa335521e6bb3ae58200116f1874f252f9a Mon Sep 17 00:00:00 2001
From: Mark Gregory <mark.gregory@abbeysoftware.com>
Date: Thu, 22 Oct 2026 18:21:49 +0100
Subject: [PATCH] Updates to scanner with CVE saving and auto update

---
 PHPGuard/SSHScanner.swift | 43 +++++++++++++++++++++++++++------------
 1 file changed, 30 insertions(+), 13 deletions(-)

diff --git a/PHPGuard/SSHScanner.swift b/PHPGuard/SSHScanner.swift
index b52fe5f..f912aec 100644
--- a/PHPGuard/SSHScanner.swift
+++ b/PHPGuard/SSHScanner.swift
@@ -172,27 +172,44 @@ enum SSHScanner {
     case "$package_manager" in
       apt)
         if command -v apt-cache >/dev/null 2>&1; then
-          dpkg-query -W -f='${Package}\n' 'php*' \
-            2>/dev/null |
-          grep -E '^php[0-9.-]*([a-z-]+)?$' |
-          sort -u |
-          while IFS= read -r pkg; do
-            [ -n "$pkg" ] || continue
+          dpkg-query -W \
+            -f='${db:Status-Abbrev}|${binary:Package}|${Version}\n' \
+            'php*' 2>/dev/null |
+          while IFS='|' read -r state pkg installed; do
+            case "$state" in ii*) ;; *) continue ;; esac
+            case "$pkg" in php*) ;; *) continue ;; esac
+            [ -n "$installed" ] || continue
 
-            installed=$(dpkg-query -W -f='${Version}' \
-              "$pkg" 2>/dev/null || true)
+            policy=$(apt-cache policy "$pkg" 2>/dev/null || true)
 
-            candidate=$(apt-cache policy "$pkg" 2>/dev/null |
+            candidate=$(printf '%s\n' "$policy" |
               sed -n 's/^[[:space:]]*Candidate: //p' |
               head -1)
 
             printf '%s installed=%s candidate=%s\n' \
               "$pkg" "$installed" "${candidate:-unknown}"
 
-            apt-cache policy "$pkg" 2>/dev/null |
-              grep -E 'https?://|/ubuntu |/ubuntu$' |
-              head -3 |
-              sed 's/^[[:space:]]*/  /'
+            # Repository matching is informational, not an attestation.
+            # Match the exact installed version and its repository entries.
+            printf '%s\n' "$policy" |
+              awk -v installed="$installed" -v pkg="$pkg" '
+                /^[[:space:]]*(\*\*\*[[:space:]]*)?[^[:space:]]+[[:space:]]+[0-9]+$/ {
+                  version=$1
+                  if (version=="***") version=$2
+                  matching=(version==installed)
+                  next
+                }
+
+                matching && /https?:\/\// {
+                  if ($0 ~ /archive[.]ubuntu[.]com\/ubuntu/ ||
+                      $0 ~ /security[.]ubuntu[.]com\/ubuntu/) {
+                    print "UBUNTU_REPOSITORY_MATCH|" pkg "|" installed
+                    matching=0
+                  } else {
+                    print "OTHER_REPOSITORY_MATCH|" pkg "|" installed
+                  }
+                }
+              '
           done
         else
           printf 'APT metadata unavailable\n'