Enhance v6 search command

[wagoodman]

Plumbs up the search command for the v6 schema with the store + presenter logic. Functionally this adds the ability to refine affected package searches by various criteria, such as vuln published date, vuln modified date, provider, distro, etc. Note that any form of date searching will be partially functional until there is more data in the DB for search conditions to key off of; in the meantime any records without date information are included in the output.

Here an additional vulnerability command has been added:

$ grype db search vuln --help

Search for vulnerabilities within the DB (supports DB schema v6+ only)

Usage:
  grype db search vuln ID... [flags]

Aliases:
  vuln, vulnerability, vulnerabilities, vulns

Flags:
  -h, --help                     help for vuln
      --limit int                limit the number of results returned (supports DB schema v6+ only) (default 5000)
      --modified-after string    only show vulnerabilities originally published or modified since the given date (format: YYYY-MM-DD) (supports DB schema v6+ only)
  -o, --output string            format to display results (available=[table, json]) (default "table")
      --provider stringArray     only show vulnerabilities from the given provider (supports DB schema v6+ only)
      --published-after string   only show vulnerabilities originally published after the given date (format: YYYY-MM-DD) (supports DB schema v6+ only)

...and the existing search for affected packages command has been enhanced:

$ grype db search --help

Search the DB for vulnerabilities or affected packages

Usage:
  grype db search VULN|PKG... [flags]

Flags:
      --distro stringArray       refine to results with the given operating system (format: 'name', 'name@version', '[email protected]', 'name@codename') (supports DB schema v6+ only)
      --ecosystem string         ecosystem of the package to search within (supports DB schema v6+ only)
  -h, --help                     help for search
      --limit int                limit the number of results returned (supports DB schema v6+ only) (default 5000)
      --modified-after string    only show vulnerabilities originally published or modified since the given date (format: YYYY-MM-DD) (supports DB schema v6+ only)
  -o, --output string            format to display results (available=[table, json]) (default "table")
      --pkg stringArray          package name/CPE/PURL to search for (supports DB schema v6+ only)
      --provider stringArray     only show vulnerabilities from the given provider (supports DB schema v6+ only)
      --published-after string   only show vulnerabilities originally published after the given date (format: YYYY-MM-DD) (supports DB schema v6+ only)
      --vuln stringArray         only show results for the given vulnerability ID (supports DB schema v6+ only)

Here's example output of searching by package:

$ grype db search --pkg log4j --distro [email protected]
VULNERABILITY   PACKAGE  ECOSYSTEM  NAMESPACE              VERSION CONSTRAINT        
CVE-2019-17571  log4j    rpm        sles:distro:sles:15.6  < 0:2.17.2-150200.4.27.45  
CVE-2020-9488   log4j    rpm        sles:distro:sles:15.6  < 0:2.17.2-150200.4.27.45  
CVE-2021-4104   log4j    rpm        sles:distro:sles:15.6  < 0:2.17.2-150200.4.27.45  
CVE-2021-42550  log4j    rpm        sles:distro:sles:15.6  < 0:2.17.2-150200.4.24.13  
CVE-2021-44228  log4j    rpm        sles:distro:sles:15.6  < 0:2.16.0-4.10.1          
CVE-2021-44832  log4j    rpm        sles:distro:sles:15.6  < 0:2.17.0-4.16.1          
CVE-2021-45046  log4j    rpm        sles:distro:sles:15.6  < 0:2.16.0-4.10.1          
CVE-2021-45105  log4j    rpm        sles:distro:sles:15.6  < 0:2.17.0-4.13.1

It also allows for fuzzier argument input:

$ grype db search ELSA-2023-12205            # same as '--vuln ELSA-2023-12205'
$ grype db search log4j                      # same as '--pkg log4j '
$ grype db search log4j CVE-2021-44228       # same as '--pkg log4j --vuln CVE-2021-44228'
$ grype db search 'pkg:rpm/redhat/openssl'   # same as '--ecosystem rpm --pkg openssl'
$ grype db search 'cpe:2.3:a:jetty:jetty_http_server:*:*:*:*:*:*'
$ grype db search 'cpe:/a:jetty:jetty_http_server'

Notice that we can specify a PURL, CPE, package name, or vulnerability ID -- the search command will attempt to parse each value and adjust the search criteria accordingly. If there is ever any ambiguity or opposition to using arbitrary args, there are still the equivalent flags for each (--pkg and --vuln).

Note that the Namespace mimics the v5 namespace values, even though this is not present in the DB today (in a future PR this code will be moved).

And similarly, example output searching by vulnerability:

$ grype db search vuln CVE-2021-4104
ID             PROVIDER                                                                                 PUBLISHED   SEVERITY                                            REFERENCE                                                 
CVE-2021-4104  debian (10, 11, 12, 13, unstable)                                                                                                                        https://security-tracker.debian.org/tracker/CVE-2021-4104  
CVE-2021-4104  debian (9)                                                                                           high                                                https://security-tracker.debian.org/tracker/CVE-2021-4104  
CVE-2021-4104  nvd                                                                                      2021-12-14  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (7.5)  https://nvd.nist.gov/vuln/detail/CVE-2021-4104             
CVE-2021-4104  rhel (7, 8)                                                                                          medium                                              https://access.redhat.com/security/cve/CVE-2021-4104       
CVE-2021-4104  sles (11.1, 11.3, 11.4, 12.2, 12.3, 12.4, 12.5, 15, 15.1, 15.2, 15.3, 15.4, 15.5, 15.6)              medium                                              https://www.suse.com/security/cve/CVE-2021-4104            
CVE-2021-4104  ubuntu (16.04, 18.04, 20.04, 21.04, 21.10, 23.04, 23.10, 24.04, 24.10)                               medium                                              https://ubuntu.com/security/CVE-2021-4104

Each command has JSON output as well, which the JSON schemas are automatically generated for (and validated in CI on pull requests).

• Closes Stabilize DB search output #2130
• Partially implements Replace grype db diff with grype db search --since DATE #2129

PR stack:

1. Rename OperatingSystemAliases #2352
2. Finalize label version and add release id to OS model #2349
3. Allow v6 store to support multiple qualifiers #2338

[willmurphyscode]

Not a blocking comment, but I'm curious: What motivates this particular fallback logic?

[wagoodman]

Here's the reasoning that went into field precedence:

• label version tends to override numeric versions ("unstable" is the label for "debian:sid" for instance). There is a good argument that codename should be here, but the only reason why it's not is because vunnel and grype-db reason about a value here over raw values from the vulnerability provider.
• if not found, then we craft the most specific version possible and return that
• we don't expect there to be many cases where there is no version information but if so, codename is the only recourse left (which tends to be empty though).