feat: handle ROOTIO_UNAFFECTED markers in OS transformer

[chait-slim]

• Recognize ROOTIO_UNAFFECTED version markers from vunnel
• Set NotAffectedFixStatus for Root.io unaffected vulnerabilities
• Handle Root.io namespace format (rootio:distro:alpine:3.17)
• Add Root.io reference URL and tags for tracking
• Include unit tests for new functionality

This enables grype-db to properly process Root.io security patches
and prevent false positive vulnerability matches.

Signed-off-by: Chai Tadmor chai.tadmor@root.io

[willmurphyscode]

In its current form, this is not the change suggested at anchore/vunnel#863 (comment) .

https://github.com/anchore/grype-db/pull/686/files#diff-af698832ba49e27cd15a534e0c885e607ec0eb94a07cd2165f03f09a2265bcbeR61-R70 has an example.

To re-iterate:

1. Vunnel should emit records that mean "rootio has published a fix for CVE X in version Y"
2. Grype-DB should pick up those records and emit UnaffectedPackageHandles in the database
3. Grype should query for those UnaffectedPackageHandle and use them to filter out packages that root-io has fixed.

[chait-slim]

In its current form, this is not the change suggested at anchore/vunnel#863 (comment) .

https://github.com/anchore/grype-db/pull/686/files#diff-af698832ba49e27cd15a534e0c885e607ec0eb94a07cd2165f03f09a2265bcbeR61-R70 has an example.

To re-iterate:

1. Vunnel should emit records that mean "rootio has published a fix for CVE X in version Y"
2. Grype-DB should pick up those records and emit UnaffectedPackageHandles in the database
3. Grype should query for those UnaffectedPackageHandle and use them to filter out packages that root-io has fixed.

@willmurphyscode I've refactored the three PRs according to the requirements and comments. Given what I understand about the project and your comments I think the PRs will meet the requirements much better now

[chait-slim]

In its current form, this is not the change suggested at anchore/vunnel#863 (comment) .
https://github.com/anchore/grype-db/pull/686/files#diff-af698832ba49e27cd15a534e0c885e607ec0eb94a07cd2165f03f09a2265bcbeR61-R70 has an example.
To re-iterate:

1. Vunnel should emit records that mean "rootio has published a fix for CVE X in version Y"
2. Grype-DB should pick up those records and emit UnaffectedPackageHandles in the database
3. Grype should query for those UnaffectedPackageHandle and use them to filter out packages that root-io has fixed.

@willmurphyscode I've refactored the three PRs according to the requirements and comments. Given what I understand about the project and your comments I think the PRs will meet the requirements much better now

Hi @willmurphyscode did you get a chance to look at the updated PRs?

[chait-slim]

In its current form, this is not the change suggested at anchore/vunnel#863 (comment) .
https://github.com/anchore/grype-db/pull/686/files#diff-af698832ba49e27cd15a534e0c885e607ec0eb94a07cd2165f03f09a2265bcbeR61-R70 has an example.
To re-iterate:

1. Vunnel should emit records that mean "rootio has published a fix for CVE X in version Y"
2. Grype-DB should pick up those records and emit UnaffectedPackageHandles in the database
3. Grype should query for those UnaffectedPackageHandle and use them to filter out packages that root-io has fixed.

@willmurphyscode I've refactored the three PRs according to the requirements and comments. Given what I understand about the project and your comments I think the PRs will meet the requirements much better now

Hi @willmurphyscode did you get a chance to look at the updated PRs?

[chait-slim]

Hi @willmurphyscode, apologies for the close/reopen notification, that was an accidental misclick on my end!

I wanted to bump this because getting this landed is currently a high priority for my team. With the holidays approaching in a couple of weeks, I’m eager to get your eyes on this so I can address any remaining requests or fixes before the break.

I’d really appreciate a review when you have a moment so we don't carry any blockers into the new year. Thanks!

[willmurphyscode]

I'm confused. This looks like a vulnerability with no fix information in a test case, but at anchore/vunnel#863 (comment) I thought you said that the rootio provider never discloses unfixed vulnerabilities.

[chait-slim]

Opened a new PR with updated spec: #790