test(seal): add tests for lookupVendor and AllowLocalSpecifier; add EXPERIMENTAL to docs

- Add unit tests for lookupVendor() covering all Seal ecosystems and non-Seal fallback
- Add tests for pep440.AllowLocalSpecifier demonstrating strict local version matching
- Add EXPERIMENTAL warning to Application Dependencies section in seal.md

Author: DmitriyLewen

docs/guide/coverage/others/seal.md

@@ -31,6 +31,9 @@ For details on supported scanners, features, and behavior for each base OS, refe
 
 ## Application Dependencies
 
+!!! warning "EXPERIMENTAL"
+    Scanning results may be inaccurate.
+
 Seal also provides patched versions of application dependencies with their own vulnerability advisories. Trivy automatically detects Seal-patched packages based on special naming patterns specific to each ecosystem.
 
 ### Supported Ecosystems

pkg/detector/library/compare/pep440/compare_test.go

@@ -114,3 +114,67 @@ func TestPep440Comparer_IsVulnerable(t *testing.T) {
 		})
 	}
 }
+
+func TestPep440Comparer_AllowLocalSpecifier(t *testing.T) {
+	type args struct {
+		currentVersion string
+		advisory       dbTypes.Advisory
+	}
+	tests := []struct {
+		name             string
+		allowLocalSpec   bool
+		args             args
+		want             bool
+	}{
+		{
+			// Without AllowLocalSpecifier, the local segment is stripped from the candidate version,
+			// so "4.2.8+sp1" matches "== 4.2.8" and is incorrectly treated as vulnerable.
+			name:           "without AllowLocalSpecifier: local segment ignored, version matches base constraint",
+			allowLocalSpec: false,
+			args: args{
+				currentVersion: "4.2.8+sp1",
+				advisory: dbTypes.Advisory{
+					VulnerableVersions: []string{"== 4.2.8"},
+					PatchedVersions:    []string{"== 4.2.9"},
+				},
+			},
+			want: true,
+		},
+		{
+			// With AllowLocalSpecifier, the local segment is compared strictly,
+			// so "4.2.8+sp999" does not fall in ">= sp1, < sp999" and is correctly not vulnerable.
+			name:           "with AllowLocalSpecifier: patched version not vulnerable",
+			allowLocalSpec: true,
+			args: args{
+				currentVersion: "4.2.8+sp999",
+				advisory: dbTypes.Advisory{
+					VulnerableVersions: []string{">= 4.2.8+sp1, < 4.2.8+sp999"},
+					PatchedVersions:    []string{"4.2.8+sp999"},
+				},
+			},
+			want: false,
+		},
+		{
+			name:           "with AllowLocalSpecifier: vulnerable version matched by local range",
+			allowLocalSpec: true,
+			args: args{
+				currentVersion: "4.2.8+sp1",
+				advisory: dbTypes.Advisory{
+					VulnerableVersions: []string{">= 4.2.8+sp1, < 4.2.8+sp999"},
+					PatchedVersions:    []string{"4.2.8+sp999"},
+				},
+			},
+			want: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var c pep440.Comparer
+			if tt.allowLocalSpec {
+				c = pep440.NewComparer(pep440.AllowLocalSpecifier())
+			}
+			got := c.IsVulnerable(tt.args.currentVersion, tt.args.advisory)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}

pkg/detector/library/vendor_test.go

@@ -0,0 +1,86 @@
+package library
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/aquasecurity/trivy-db/pkg/ecosystem"
+	"github.com/aquasecurity/trivy/pkg/detector/library/compare"
+	"github.com/aquasecurity/trivy/pkg/detector/library/compare/pep440"
+)
+
+func Test_lookupVendor(t *testing.T) {
+	defaultComparer := compare.GenericComparer{}
+
+	tests := []struct {
+		name            string
+		eco             ecosystem.Type
+		pkgName         string
+		wantPrefix      string
+		wantComparerNil bool // true if the default comparer should be returned unchanged
+	}{
+		{
+			name:            "seal pip package returns vendor prefix and pep440 comparer",
+			eco:             ecosystem.Pip,
+			pkgName:         "seal-requests",
+			wantPrefix:      "seal pip::",
+			wantComparerNil: false,
+		},
+		{
+			name:            "seal npm package returns vendor prefix and default comparer",
+			eco:             ecosystem.Npm,
+			pkgName:         "@seal-security/ejs",
+			wantPrefix:      "seal npm::",
+			wantComparerNil: true,
+		},
+		{
+			name:            "seal go package returns vendor prefix and default comparer",
+			eco:             ecosystem.Go,
+			pkgName:         "sealsecurity.io/github.com/foo/bar",
+			wantPrefix:      "seal go::",
+			wantComparerNil: true,
+		},
+		{
+			name:            "seal maven package returns vendor prefix and default comparer",
+			eco:             ecosystem.Maven,
+			pkgName:         "seal.sp1.org.eclipse.jetty:jetty-http",
+			wantPrefix:      "seal maven::",
+			wantComparerNil: true,
+		},
+		{
+			name:            "seal rubygems package returns vendor prefix and default comparer",
+			eco:             ecosystem.RubyGems,
+			pkgName:         "seal-rack",
+			wantPrefix:      "seal rubygems::",
+			wantComparerNil: true,
+		},
+		{
+			name:            "non-seal pip package returns standard prefix",
+			eco:             ecosystem.Pip,
+			pkgName:         "requests",
+			wantPrefix:      "pip::",
+			wantComparerNil: true,
+		},
+		{
+			name:            "non-seal npm package returns standard prefix",
+			eco:             ecosystem.Npm,
+			pkgName:         "ejs",
+			wantPrefix:      "npm::",
+			wantComparerNil: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			gotPrefix, gotComparer := lookupVendor(tt.eco, tt.pkgName, "", defaultComparer)
+			assert.Equal(t, tt.wantPrefix, gotPrefix)
+			if tt.wantComparerNil {
+				assert.Equal(t, defaultComparer, gotComparer)
+			} else {
+				// For seal pip, a custom pep440 comparer with AllowLocalSpecifier should be returned.
+				assert.IsType(t, pep440.Comparer{}, gotComparer)
+			}
+		})
+	}
+}