test(vuln): check that every OS driver narrows the package set

Add a conformance test over the registered drivers, plus a filtering test for
Echo. Dropping third-party packages is the default expectation, so a driver
that keeps them has to be listed explicitly.

Author: DmitriyLewen

pkg/detector/ospkg/detect_test.go

@@ -195,3 +195,35 @@ func TestNewDetector(t *testing.T) {
 		})
 	}
 }
+
+// TestDriversFilterThirdPartyPackages checks that every registered driver narrows the
+// package set, so a driver whose FilterPackages became a no-op is caught here.
+// Provider-built drivers (Root.io, Seal) are not registered and have their own tests.
+func TestDriversFilterThirdPartyPackages(t *testing.T) {
+	// Drivers whose own advisories describe third-party packages, so they keep them.
+	// Dropping is the default: keeping has to be listed here explicitly.
+	keepsThirdPartyPackages := map[ftypes.OSType]bool{
+		ftypes.Echo: true,
+	}
+
+	thirdParty := ftypes.Package{
+		Name: "nginx",
+		Repository: ftypes.PackageRepository{
+			Class: ftypes.RepositoryClassThirdParty,
+		},
+	}
+
+	for family, drv := range ospkg.Drivers() {
+		t.Run(string(family), func(t *testing.T) {
+			got := drv.FilterPackages(t.Context(), []ftypes.Package{thirdParty})
+
+			if keepsThirdPartyPackages[family] {
+				assert.Equal(t, []ftypes.Package{thirdParty}, got,
+					"%s reads its own advisory feed, so it must keep third-party packages", family)
+				return
+			}
+			assert.Empty(t, got,
+				"%s matches against the OS vendor's advisories, so it must drop third-party packages", family)
+		})
+	}
+}

pkg/detector/ospkg/echo/echo_test.go

@@ -267,3 +267,48 @@ func TestScanner_Detect(t *testing.T) {
 		})
 	}
 }
+
+func TestScanner_FilterPackages(t *testing.T) {
+	// Echo publishes advisories for software Debian does not ship, which users
+	// install from the vendor's own repository, so those packages must be kept.
+	thirdParty := ftypes.Package{
+		Name: "docker-compose-plugin",
+		Repository: ftypes.PackageRepository{
+			Class: ftypes.RepositoryClassThirdParty,
+		},
+	}
+	official := ftypes.Package{
+		Name: "curl",
+		Repository: ftypes.PackageRepository{
+			Class: ftypes.RepositoryClassOfficial,
+		},
+	}
+
+	tests := []struct {
+		name string
+		pkgs []ftypes.Package
+		want []ftypes.Package
+	}{
+		{
+			name: "package from a third-party repository is kept",
+			pkgs: []ftypes.Package{thirdParty},
+			want: []ftypes.Package{thirdParty},
+		},
+		{
+			name: "package from an official repository is kept",
+			pkgs: []ftypes.Package{official},
+			want: []ftypes.Package{official},
+		},
+		{
+			name: "no package is dropped",
+			pkgs: []ftypes.Package{official, thirdParty},
+			want: []ftypes.Package{official, thirdParty},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, NewScanner().FilterPackages(t.Context(), tt.pkgs))
+		})
+	}
+}

pkg/detector/ospkg/export_test.go

@@ -0,0 +1,11 @@
+package ospkg
+
+import (
+	"github.com/aquasecurity/trivy/pkg/detector/ospkg/driver"
+	ftypes "github.com/aquasecurity/trivy/pkg/fanal/types"
+)
+
+// Bridge to expose ospkg internals to tests in the ospkg_test package.
+
+// Drivers exports drivers for testing.
+var Drivers = func() map[ftypes.OSType]driver.Driver { return drivers }