feat(ubuntu): match FIPS packages against the dedicated FIPS bucket

[Bit-Doctor]

Summary

Make the Ubuntu detector query a dedicated FIPS advisory bucket for FIPS-validated packages.

Ubuntu ships FIPS-validated packages (e.g. openssl) that are fixed on its FIPS streams (fips/, fips-updates/, fips-preview/). The companion trivy-db change stores those advisories in a dedicated ubuntu <version>-FIPS bucket instead of the regular release bucket, so FIPS and non-FIPS fixed versions no longer collide.

This PR teaches the scanner to:

• detect a FIPS package by the FIPS version marker Ubuntu adds (+Fips/+fips, or .fips.), and
• for those packages, query the <version>-FIPS bucket; non-FIPS packages keep querying the regular release bucket.

As a result FIPS-validated fixes are shown only to FIPS users, and non-FIPS users are unaffected.

Changes

• pkg/detector/ospkg/ubuntu/ubuntu.go
  • Resolve the base release once, then per package append -FIPS when isFIPSPackage(pkg) before calling VulnSrc.Get.
  • Add the isFIPSPackage helper (checks binary and source version strings, case-insensitive).
• pkg/detector/ospkg/ubuntu/ubuntu_test.go: add a FIPS-package case (matched in ubuntu 20.04-FIPS) and a non-FIPS case (must not match the FIPS bucket).
• testdata/fixtures/{ubuntu,data-source}.yaml: add an ubuntu 20.04-FIPS bucket + data source.

No go.mod bump is required: the scanner only changes the bucket-name string passed to Get. The real -FIPS buckets are produced by the companion trivy-db PR once the DB is rebuilt.

Companion PR

• trivy-db: https://github.com/DataDog/trivy-db/pull/60

References

• Upstream discussion: feat(ubuntu): add missing stream release mappings to Ubuntu aquasecurity/trivy-db#664

Testing

go test ./pkg/detector/ospkg/ubuntu/... passes.

Made with Cursor

[LucasChevrierGit]

Just one comment, otherwise LGTM. ✅

[LucasChevrierGit]

release can be ESM-suffixed (e.g. "18.04-ESM"), so pkgRelease += "-FIPS" produces "18.04-ESM-FIPS" — a bucket that doesn't exist. Hosts with both esm-infra and FIPS enabled would silently get zero FIPS results. Build the FIPS bucket off the base release instead:

Suggested change

	release := s.versionFromEolDates(ctx, osVer)
	var vulns []types.DetectedVulnerability
	for _, pkg := range pkgs {
	// Skip third-party packages as they are not covered by Ubuntu security advisories
	if pkg.Repository.Class == ftypes.RepositoryClassThirdParty {
	continue
	}
	release := s.versionFromEolDates(ctx, osVer)
	baseRelease := strings.TrimSuffix(release, "-ESM")
	var vulns []types.DetectedVulnerability
	for _, pkg := range pkgs {
	// Skip third-party packages as they are not covered by Ubuntu security advisories
	if pkg.Repository.Class == ftypes.RepositoryClassThirdParty {
	continue
	}
	// FIPS advisories live in a "<base-version>-FIPS" bucket ("-ESM" and
	// "-FIPS" never combine), so strip any "-ESM" suffix first.
	pkgRelease := release
	if isFIPSPackage(pkg) {
	pkgRelease = baseRelease + "-FIPS"
	}