feat!(detector): route NVD to vuls2

[shino]

What

Route all NVD-derived data through the vuls2 library — both CPE detection and enrichment (CveContent, exploits, mitigations, US-CERT alerts) — while keeping go-cve-dictionary for the sources vuls2 does not carry (JVN / JP-CERT, Cisco, Paloalto, Fortinet, VulnCheck, EUVD, MITRE).

Companion to the vuls-data-update / vuls2 work this pins via go.mod (latest: MaineK00n/vuls-data-update#850, MaineK00n/vuls2#388).

Why

• go-cve-dictionary's CPE path matches NVD by version-range comparison only, which cannot decide membership for non-semver version formats (cisco ios 15.1(4)m3, juniper junos 21.4r3) and suffers a go-cpe numeric-prefix over-match (5.15.10 matching a 5.15.103 query). The vuls2 DB carries the NVD feed with cpematch-expanded criteria, fixing both.
• Consolidating NVD in vuls2 means detection and enrichment share one NVD source and emit a single canonical nvd CveContent, instead of go-cve-dictionary's per-CVSS-source multi-entry set.

What moves where

Data	Path
NVD CPE detection	vuls2 (DetectCPEs, cpematch-expanded criteria)
NVD CveContent / exploits / mitigations / US-CERT alerts	vuls2 (EnrichVulnInfos → enrichNVD)
JVN / JP-CERT, Cisco, Paloalto, Fortinet, VulnCheck, EUVD, MITRE	go-cve-dictionary

How

Match quality is decided upstream. vuls-data-update's cpecriterion.Accept returns a MatchQuality (Exact / VersionUnconfirmed), and accept indexes are bucketed by quality in the extracted criterion. vuls0 no longer re-derives CPE semantics — walkCPECriteria is a pure projection of Accepts.CPE.{Exact,VersionUnconfirmed} onto two confidence tiers: ExactVersionMatch (100) and VendorProductMatch (10). go-cve-dictionary's middle RoughVersionMatch (80) is retired, and the old version-range vendorProductEligible fallback is gone (the version-unconfirmed tier replaces it).

NVD enrichment (enrichNVD) builds the single nvd CveContent (CVSS / summary / CWE / references), plus NVD exploits/mitigations and US-CERT alerts (NVD references whose URL contains us-cert), mirroring the detection path. It is gated so it never duplicates a CVE the CPE detection already filled. go-cve-dictionary's NVD contribution (detection, CveContent, US-CERT) is stripped; JP-CERT (from JVN) and the JVNDB advisory gating stay on the dictionary path.

detector API stays master-shaped (DetectPkgCves → DetectCpeURIsCves) so library consumers are unaffected. EnrichVulnInfos runs between them and sets AlertDict.USCERT; the dictionary fill that follows now sets only .JPCERT, preserving it.

deps: vuls2 98ac8e5 (nightly, #388), vuls-data-update bfedbc24 (#850). Builds standalone — no go.work overrides.

Testing

• go test ./... green; gofmt clean.
• vuls-compare over CPE-bearing fixtures (apache / cisco non-semver / linux_kernel over-match / juniper): detected CVE sets match the classic dictionary path (0 over-detect, 0 missed). NVD CveContent intentionally changes shape — vuls2's single canonical entry vs the dictionary's per-CVSS-source set.
• NVD detection + enrich verified against a locally-built NVD vuls2 DB (vuls db add nvd-feed-cve-v2) with an empty go-cve-dictionary, confirming NVD flows entirely through vuls2:
  • CPE detection (openssl 1.0.1f): 74 CVEs via vuls2, all carrying nvd content (NvdExactVersionMatch).
  • enrich (rhel_90): nvd CveContents go 0 → 7018 with the NVD DB, unchanged with empty gocve (vs 5194 multi-entry on the dictionary path).
  • US-CERT: Heartbleed (CVE-2014-0160) → US-CERT-TA14-098A, surviving the dictionary fill step.

[Copilot]

Pull request overview

This PR reroutes NVD-based CPE detection to the vuls2 DB (to leverage cpematch-expanded criteria and avoid version-format pitfalls) while keeping go-cve-dictionary CPE detection for non-NVD sources (JVN, Cisco, Paloalto, Fortinet, Vulncheck, EUVD, MITRE, etc.). It also updates vuls2-path data conversion to preserve user-supplied CPE forms and to carry exploit/mitigation metadata through merges.

Changes:

• Update the vuls2 detector to run CPE detection (NVD) alongside OS-package detection in one DB session and convert CPEs to/from CPE 2.3 FS.
• Update the main detector flow to run go-cve-dictionary CPE detection first (stripping NVD) and then run vuls2 detection.
• Bump dependencies (vuls2, vuls-data-update, and related indirect modules) and update tests/source ID handling.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
detector/detector.go	Collect CPEs from scan result snapshot + OWASP + synthesized Apple CPEs; strip NVD results from go-cve-dict CPE detection; run unified vuls2 detection afterwards.
detector/vuls2/vuls2.go	Add vuls2 CPE detection path, CPE FS conversion/restoration, CPE-AND relax pruning, exploit/mitigation conversion & merge behavior.
detector/vuls2/vendor.go	Update Red Hat VEX source ID handling and sorting/tag comparison logic.
detector/vuls2/vuls2_test.go	Update tests for new exported helper signatures and updated criterion/source types.
go.mod	Pin updated vuls2 and vuls-data-update versions and bump several direct/indirect deps.
go.sum	Module sum updates corresponding to dependency bumps.

Comments suppressed due to low confidence (1)

detector/vuls2/vuls2.go:101

• When merging vuls2-detected VulnInfo into an existing r.ScannedCves entry (e.g., after DetectCpeURIsCves ran first), the merge currently ignores CpeURIs, Exploits, and Mitigations, so those fields can be silently dropped for CVEs present in both paths. Also, viBase.CveContents may be nil for existing entries, which would panic on assignment.

	vulnInfos, err := postConvert(vuls2Scanned, vuls2Detected, fsToOriginalCPE)
	if err != nil {
		return xerrors.Errorf("Failed to post convert. err: %w", err)
	}

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 4 comments.

[MaineK00n]

enrichNVD has no unit test coverage in the enrich path.

Test_enrich covers the other enrich sources (redhat-cve, cisa-kev, vulncheck-kev, enisa-kev, metasploit, exploit-*, nuclei-repository), but there's no NVD case, and testdata/fixtures/enrich/ has no nvd-feed-cve-v2 fixture. As a result, enrichNVD — the core of this refactor (851aa34, 8c59083) — is never exercised through the enrich entry point.

The NVD content assembly (toReference, exploit/mitigation lifting, CVSS mapping) is tested via Test_postConvert, but that's the detection-time postConvert path, not enrichNVD. Specifically, these branches are currently untested:

1. NVDFeedCVEv2 -> enrichNVD dispatch and CveContent/Exploit/Mitigation generation when there's no pre-existing NVD content (hasContent == false).
2. hasContent == true skip path — NVD CveContent already filled by the CPE detection path, so content/exploits/mitigations must be left in place.
3. US-CERT alert derivation — no fixture anywhere contains a us-cert reference URL, so the single place US-CERT is now produced has zero coverage.

Could you add an nvd-feed-cve-v2 fixture to testdata/fixtures/enrich/ and a Test_enrich case (or two) covering:

• hasContent == false: NVD CveContent + Exploit + Mitigation are generated, and US-CERT alerts are appended from a us-cert reference URL.
• hasContent == true: existing NVD CveContent is preserved (not duplicated/overwritten), while US-CERT is still derived.

This would lock in both behaviors the refactor introduced and guard against regressions in the go-cve-dictionary -> vuls2 migration.

[shino]

Thanks — added in 6fc364b.

testdata/fixtures/enrich/nvd-feed-cve-v2/ (CVE-2014-0160) + two Test_enrich cases now exercise enrichNVD through the enrich entry point:

• hasContent == false: NVDFeedCVEv2 -> enrichNVD dispatch generates the nvd CveContent, the NVD Exploit and Mitigation, and appends a US-CERT alert derived from a us-cert reference URL (US-CERT-TA14-098A).
• hasContent == true: a pre-existing nvd CveContent (as the CPE detection path leaves it) is preserved — not duplicated/overwritten, exploits/mitigations not re-added — while US-CERT is still derived.

The fixture carries a us-cert reference so the US-CERT derivation path has coverage for the first time.

[MaineK00n]

🪦

[shino]

CI does not run, close temporally with wishes