fix(rpc): propagate package repository class in client/server mode

Repository.Class (third-party indicator) was not part of the RPC Package message, so in client/server mode and the remote cache it was lost.
As a result the third-party vulnerability skip did not run on the server side, producing false positives for third-party OS packages (e.g. nodejs from NodeSource).

Author: DmitriyLewen

pkg/rpc/convert.go

@@ -77,11 +77,22 @@ func ConvertToRPCPkgs(pkgs []ftypes.Package) []*common.Package {
 			Indirect:     pkg.Indirect,
 			Maintainer:   pkg.Maintainer,
 			AnalyzedBy:   string(pkg.AnalyzedBy),
+			Repository:   ConvertToRPCPackageRepository(pkg.Repository),
 		})
 	}
 	return rpcPkgs
 }
 
+// ConvertToRPCPackageRepository converts ftypes.PackageRepository to common.PackageRepository
+func ConvertToRPCPackageRepository(repo ftypes.PackageRepository) *common.PackageRepository {
+	if repo.Class == "" {
+		return nil
+	}
+	return &common.PackageRepository{
+		Class: string(repo.Class),
+	}
+}
+
 func ConvertToRPCPkgIdentifier(pkg ftypes.PkgIdentifier) *common.PkgIdentifier {
 	if pkg.Empty() {
 		return nil
@@ -233,11 +244,22 @@ func ConvertFromRPCPkgs(rpcPkgs []*common.Package) []ftypes.Package {
 			Indirect:     pkg.Indirect,
 			Maintainer:   pkg.Maintainer,
 			AnalyzedBy:   ftypes.AnalyzerType(pkg.AnalyzedBy),
+			Repository:   ConvertFromRPCPackageRepository(pkg.Repository),
 		})
 	}
 	return pkgs
 }
 
+// ConvertFromRPCPackageRepository converts common.PackageRepository to ftypes.PackageRepository
+func ConvertFromRPCPackageRepository(repo *common.PackageRepository) ftypes.PackageRepository {
+	if repo == nil {
+		return ftypes.PackageRepository{}
+	}
+	return ftypes.PackageRepository{
+		Class: ftypes.RepositoryClass(repo.GetClass()),
+	}
+}
+
 func ConvertFromRPCPkgIdentifier(pkg *common.PkgIdentifier) ftypes.PkgIdentifier {
 	if pkg == nil {
 		return ftypes.PkgIdentifier{}

pkg/rpc/convert_test.go

@@ -59,6 +59,9 @@ func TestConvertToRpcPkgs(t *testing.T) {
 						Digest:       "SHA1:901a7b55410321c4d35543506cff2a8613ef5aa2",
 						Indirect:     true,
 						Relationship: ftypes.RelationshipIndirect,
+						Repository: ftypes.PackageRepository{
+							Class: ftypes.RepositoryClassThirdParty,
+						},
 						Identifier: ftypes.PkgIdentifier{
 							UID: "01",
 						},
@@ -94,6 +97,9 @@ func TestConvertToRpcPkgs(t *testing.T) {
 					Digest:       "SHA1:901a7b55410321c4d35543506cff2a8613ef5aa2",
 					Indirect:     true,
 					Relationship: 4,
+					Repository: &common.PackageRepository{
+						Class: "third-party",
+					},
 					Identifier: &common.PkgIdentifier{
 						Uid: "01",
 					},
@@ -225,6 +231,9 @@ func TestConvertFromRpcPkgs(t *testing.T) {
 							Uid: "63f8bef824b960e3",
 						},
 						Maintainer: "alice@example.com",
+						Repository: &common.PackageRepository{
+							Class: "third-party",
+						},
 					},
 				},
 			},
@@ -261,6 +270,9 @@ func TestConvertFromRpcPkgs(t *testing.T) {
 						UID: "63f8bef824b960e3",
 					},
 					Maintainer: "alice@example.com",
+					Repository: ftypes.PackageRepository{
+						Class: ftypes.RepositoryClassThirdParty,
+					},
 				},
 			},
 		},
@@ -273,6 +285,31 @@ func TestConvertFromRpcPkgs(t *testing.T) {
 	}
 }
 
+func TestConvertPackageRepository(t *testing.T) {
+	tests := []struct {
+		name    string
+		repo    ftypes.PackageRepository
+		rpcRepo *common.PackageRepository
+	}{
+		{
+			name:    "third-party",
+			repo:    ftypes.PackageRepository{Class: ftypes.RepositoryClassThirdParty},
+			rpcRepo: &common.PackageRepository{Class: "third-party"},
+		},
+		{
+			name:    "empty class maps to nil",
+			repo:    ftypes.PackageRepository{},
+			rpcRepo: nil,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.rpcRepo, ConvertToRPCPackageRepository(tt.repo))
+			assert.Equal(t, tt.repo, ConvertFromRPCPackageRepository(tt.rpcRepo))
+		})
+	}
+}
+
 func TestConvertToRpcVulns(t *testing.T) {
 	fixedPublishedDate := time.Unix(1257894000, 0)
 	fixedLastModifiedDate := time.Unix(1257894010, 0)