,
+
+ #[serde(default, skip_serializing_if = "IsDefault::is_default")]
+ pub advisories: RequestedField {
@@ -102,6 +140,7 @@ impl {
head: SbomHead::from_entity(&sbom, &node, db).await?,
source_document: SourceDocument::from_entity(&source_document),
described_by,
+ advisories: RequestedField::NotRequested,
})
}
@@ -111,6 +150,7 @@ impl {
pub async fn from_entities {
let mut describes_map = service.batch_describes_packages(&sbom_ids, db).await?;
let counts_map = service.batch_package_counts(&sbom_ids, db).await?;
+ let advisories_map = if include_advisories {
+ Some(
+ service
+ .batch_advisory_severity_counts(&sbom_ids, db)
+ .await?,
+ )
+ } else {
+ None
+ };
let results = entities
.into_iter()
- .map(|(sbom, node, source_document)| SbomSummary {
- head: SbomHead {
- id: sbom.sbom_id,
- document_id: sbom.document_id,
- labels: sbom.labels,
- published: sbom.published,
- authors: sbom.authors,
- suppliers: sbom.suppliers,
- name: node.name,
- data_licenses: sbom.data_licenses,
- number_of_packages: counts_map.get(&sbom.sbom_id).copied().unwrap_or(0),
- },
- source_document: SourceDocument::from_entity(&source_document),
- described_by: describes_map.remove(&sbom.sbom_id).unwrap_or_default(),
+ .map(|(sbom, node, source_document)| {
+ let advisory_summary = advisories_map
+ .as_ref()
+ .and_then(|m| m.get(&sbom.sbom_id).cloned());
+ SbomSummary {
+ head: SbomHead {
+ id: sbom.sbom_id,
+ document_id: sbom.document_id,
+ labels: sbom.labels,
+ published: sbom.published,
+ authors: sbom.authors,
+ suppliers: sbom.suppliers,
+ name: node.name,
+ data_licenses: sbom.data_licenses,
+ number_of_packages: counts_map.get(&sbom.sbom_id).copied().unwrap_or(0),
+ },
+ source_document: SourceDocument::from_entity(&source_document),
+ described_by: describes_map.remove(&sbom.sbom_id).unwrap_or_default(),
+ advisories: include_advisories
+ .then_requested(|| Some(advisory_summary.unwrap_or_default())),
+ }
})
.collect();
diff --git a/modules/fundamental/src/sbom/model/raw_sql.rs b/modules/fundamental/src/sbom/model/raw_sql.rs
index 6ba8119d8..287bb023b 100644
--- a/modules/fundamental/src/sbom/model/raw_sql.rs
+++ b/modules/fundamental/src/sbom/model/raw_sql.rs
@@ -34,6 +34,171 @@ pub const CONTEXT_CPE_FILTER_SQL: &str = r#"
)
"#;
+/// Returns SQL that counts affected vulnerabilities grouped by severity for
+/// multiple SBOMs in a single query. Combines both PURL-based matching (via
+/// `purl_status` + `version_matches()`) and CPE-based matching (via
+/// `product_status` + package name matching). Takes `$1 = Uuid[]` and returns
+/// `(sbom_id, severity, count)` rows.
+///
+/// Uses a shared `sbom_purl_info` CTE (referenced 3x) that PostgreSQL
+/// auto-materializes, acting as a barrier that prevents the planner from
+/// inlining the SBOM's package set and scanning the full `versioned_purl`
+/// table. The advisory filter is deferred to a separate CTE so the
+/// expensive `version_matches()` narrows the set before any advisory
+/// lookups.
+pub fn batch_severity_counts_sql() -> &'static str {
+ r#"
+ WITH
+ -- Unnest the input array of SBOM IDs
+ input_sboms AS (
+ SELECT unnest($1::uuid[]) AS sbom_id
+ ),
+
+ -- Shared CTE: SBOM package info including version, base_purl_id,
+ -- and name/namespace. Referenced 3x so PostgreSQL auto-materializes
+ -- it, preventing the planner from inlining and scanning the full
+ -- versioned_purl table. Including base_purl here nudges the planner
+ -- to hash the small side (20k rows) instead of the large one (1.6M).
+ sbom_purl_info AS (
+ SELECT
+ spr.sbom_id,
+ vp.version,
+ vp.base_purl_id,
+ bp.name,
+ bp.namespace
+ FROM input_sboms i
+ JOIN sbom_node_purl_ref spr ON spr.sbom_id = i.sbom_id
+ JOIN qualified_purl qp ON spr.qualified_purl_id = qp.id
+ JOIN versioned_purl vp ON qp.versioned_purl_id = vp.id
+ JOIN base_purl bp ON vp.base_purl_id = bp.id
+ ),
+
+ -- PURL-based matching: version_matches called only for SBOM's packages,
+ -- advisory filter deferred to avoid unnecessary lookups.
+ purl_version_matches AS (
+ SELECT DISTINCT
+ sp.sbom_id,
+ pst.advisory_id,
+ pst.vulnerability_id
+ FROM sbom_purl_info sp
+ JOIN purl_status pst ON pst.base_purl_id = sp.base_purl_id
+ JOIN version_range vr ON pst.version_range_id = vr.id
+ JOIN status ON pst.status_id = status.id
+ WHERE status.slug = 'affected'
+ AND version_matches(sp.version, vr.*)
+ ),
+ purl_matches AS (
+ SELECT pm.sbom_id, pm.advisory_id, pm.vulnerability_id
+ FROM purl_version_matches pm
+ WHERE NOT EXISTS (
+ SELECT 1 FROM advisory a
+ WHERE a.id = pm.advisory_id AND a.deprecated
+ )
+ ),
+
+ -- CPE-based matching: per-SBOM allowed CPE IDs with generalized matching
+ sbom_cpes AS (
+ SELECT i.sbom_id, cpe.*
+ FROM input_sboms i
+ JOIN sbom_describing_cpe sdc ON sdc.sbom_id = i.sbom_id
+ JOIN cpe ON sdc.cpe_id = cpe.id
+ ),
+ sbom_generalized_cpes AS (
+ SELECT sc.sbom_id, c.*
+ FROM sbom_cpes sc
+ JOIN cpe c ON c.vendor = sc.vendor
+ AND c.product = sc.product
+ AND c.version = split_part(sc.version, '.', 1)
+ AND (c.edition IS NULL OR c.edition = '*')
+ ),
+ sbom_allowed_cpes AS (
+ SELECT sbom_id, id AS cpe_id FROM sbom_cpes
+ UNION
+ SELECT sbom_id, id AS cpe_id FROM sbom_generalized_cpes
+ ),
+ sbom_has_cpes AS (
+ SELECT DISTINCT sbom_id FROM sbom_cpes
+ ),
+
+ -- CPE product_status matches by name
+ cpe_matches_name AS (
+ SELECT DISTINCT
+ sp.sbom_id,
+ ps.advisory_id,
+ ps.vulnerability_id
+ FROM product_status ps
+ JOIN sbom_purl_info sp ON ps.package = sp.name
+ JOIN status ON ps.status_id = status.id
+ JOIN advisory ON ps.advisory_id = advisory.id
+ WHERE status.slug = 'affected'
+ AND advisory.deprecated = false
+ AND (
+ ps.context_cpe_id IS NULL
+ OR ps.context_cpe_id IN (SELECT cpe_id FROM sbom_allowed_cpes sac WHERE sac.sbom_id = sp.sbom_id)
+ OR sp.sbom_id NOT IN (SELECT sbom_id FROM sbom_has_cpes)
+ )
+ ),
+
+ -- CPE product_status matches by namespace/name
+ cpe_matches_ns AS (
+ SELECT DISTINCT
+ sp.sbom_id,
+ ps.advisory_id,
+ ps.vulnerability_id
+ FROM product_status ps
+ JOIN sbom_purl_info sp ON ps.package = CONCAT(sp.namespace, '/', sp.name)
+ JOIN status ON ps.status_id = status.id
+ JOIN advisory ON ps.advisory_id = advisory.id
+ WHERE sp.namespace IS NOT NULL
+ AND status.slug = 'affected'
+ AND advisory.deprecated = false
+ AND (
+ ps.context_cpe_id IS NULL
+ OR ps.context_cpe_id IN (SELECT cpe_id FROM sbom_allowed_cpes sac WHERE sac.sbom_id = sp.sbom_id)
+ OR sp.sbom_id NOT IN (SELECT sbom_id FROM sbom_has_cpes)
+ )
+ ),
+
+ -- Union all matches
+ all_affected AS (
+ SELECT * FROM purl_matches
+ UNION
+ SELECT * FROM cpe_matches_name
+ UNION
+ SELECT * FROM cpe_matches_ns
+ ),
+
+ -- Pick the highest severity per (sbom, advisory, vulnerability),
+ -- collapsing multiple CVSS versions (e.g. v2 + v3.1) into one row.
+ -- Unknown (no CVSS score) is treated as the highest severity.
+ scored AS (
+ SELECT DISTINCT ON (a.sbom_id, a.advisory_id, a.vulnerability_id)
+ a.sbom_id,
+ COALESCE(avs.severity::text, 'unknown') AS severity
+ FROM all_affected a
+ LEFT JOIN advisory_vulnerability_score avs
+ ON avs.advisory_id = a.advisory_id
+ AND avs.vulnerability_id = a.vulnerability_id
+ ORDER BY a.sbom_id, a.advisory_id, a.vulnerability_id,
+ CASE avs.severity::text
+ WHEN 'critical' THEN 5
+ WHEN 'high' THEN 4
+ WHEN 'medium' THEN 3
+ WHEN 'low' THEN 2
+ WHEN 'none' THEN 1
+ ELSE 6
+ END DESC
+ )
+
+ SELECT
+ sbom_id,
+ severity,
+ COUNT(*) AS count
+ FROM scored
+ GROUP BY sbom_id, severity
+ "#
+}
+
pub fn product_advisory_info_sql() -> String {
r#"
WITH
diff --git a/modules/fundamental/src/sbom/service/sbom.rs b/modules/fundamental/src/sbom/service/sbom.rs
index 854e81a12..d7e9fa428 100644
--- a/modules/fundamental/src/sbom/service/sbom.rs
+++ b/modules/fundamental/src/sbom/service/sbom.rs
@@ -4,8 +4,9 @@ use crate::{
common::license_filtering::{LICENSE, license_text_coalesce},
purl::model::summary::purl::PurlSummary,
sbom::model::{
- ModelCatcher, SbomExternalPackageReference, SbomModel, SbomNodeReference, SbomPackage,
- SbomPackageRelation, SbomPackageSummary, SbomSummary, Which, details::SbomDetails,
+ AffectedSeverity, ModelCatcher, SbomAdvisorySummary, SbomExternalPackageReference,
+ SbomModel, SbomNodeReference, SbomPackage, SbomPackageRelation, SbomPackageSummary,
+ SbomSummary, Which, details::SbomDetails, raw_sql,
},
};
use sea_orm::{
@@ -46,6 +47,7 @@ use trustify_entity::{
pub struct FetchOptions {
labels: Labels,
groups: Option