foreman_cve_scanner 0.6.1 → 0.7.1

data/app/views/foreman_cve_scanner/job_templates/install_cve_scanners.erb

@@ -5,80 +5,117 @@ description_format: 'Install CVE scanners on a host'
 model: JobTemplate
 job_category: Security
 provider_type: script
+foreign_input_sets:
+- template: Package Action - Script Default
+  exclude: action,package
 template_inputs:
-- name: trivy_version
-  description: 'Trivy version to install'
-  required: true
+- name: install_from_github
+  description: 'Install scanner release packages directly from GitHub'
+  required: false
   input_type: user
   advanced: false
-  default: 0.53.0
+  value_type: plain
+  hidden_value: false
+  default: "false"
+  options: "true\r\nfalse"
+- name: trivy_version
+  description: 'Trivy version to install from GitHub'
+  required: false
+  input_type: user
+  advanced: true
+  value_type: plain
+  hidden_value: false
+  default: "0.71.2"
 - name: grype_version
-  description: 'Grype version to install'
-  required: true
+  description: 'Grype version to install from GitHub'
+  required: false
   input_type: user
-  advanced: false
-  default: 0.79.3
+  advanced: true
+  value_type: plain
+  hidden_value: false
+  default: "0.115.0"
 - name: scanner_to_install
   description: 'Choose which scanner to install (Default: both)'
   required: false
   input_type: user
   advanced: false
-  default: both
+  value_type: plain
+  hidden_value: false
+  default: "both"
   options: "both\r\ntrivy\r\ngrype"
 %>
-# Install CVE scanners from github
 <%
-trivy_version = input('trivy_version')
-grype_version = input('grype_version')
+install_from_github = input('install_from_github') == 'true'
+scanner_to_install = input('scanner_to_install').present? ? input('scanner_to_install') : 'both'
+trivy_version = input('trivy_version').present? ? input('trivy_version') : '0.71.2'
+grype_version = input('grype_version').present? ? input('grype_version') : '0.115.0'
+os_family = @host.operatingsystem.family
 
-case @host.operatingsystem.family.to_s
-when 'Debian'
-  pkg = 'deb'
-when 'Redhat', 'Suse'
-  pkg = 'rpm'
-else
-  raise("OS '#{@host.operatingsystem.family}' not supported by template #{template_name}")
-end
+selected_scanners = case scanner_to_install
+                    when 'trivy'
+                      ['trivy']
+                    when 'grype'
+                      ['grype']
+                    else
+                      %w[trivy grype]
+                    end
+package_list = selected_scanners.join(' ')
 
-case @host.architecture.to_s
-when 'x86_64'
-  trivy_arch = 'Linux-64bit'
-  grype_arch = 'linux_amd64'
-when 'ppc64le'
-  trivy_arch = 'Linux-PPC64LE'
-  grype_arch = 'linux_ppc64le'
-when 'aarch64'
-  trivy_arch = 'Linux-ARM64'
-  grype_arch = 'linux_arm64'
-else
-  raise("Architecture '#{@host.architecture}' not supported by template #{template_name}")
-end
+if install_from_github
+  case os_family
+  when 'Debian'
+    pkg = 'deb'
+  when 'Redhat', 'Suse'
+    pkg = 'rpm'
+  else
+    raise("OS '#{@host.operatingsystem.family}' not supported by template #{template_name}")
+  end
 
-trivy_url = "https://github.com/aquasecurity/trivy/releases/download/v#{trivy_version}/trivy_#{trivy_version}_#{trivy_arch}.#{pkg}"
-grype_url = "https://github.com/anchore/grype/releases/download/v#{grype_version}/grype_#{grype_version}_#{grype_arch}.#{pkg}"
+  case @host.architecture.name
+  when 'x86_64'
+    trivy_arch = 'Linux-64bit'
+    grype_arch = 'linux_amd64'
+  when 'ppc64le'
+    trivy_arch = 'Linux-PPC64LE'
+    grype_arch = 'linux_ppc64le'
+  when 'aarch64'
+    trivy_arch = 'Linux-ARM64'
+    grype_arch = 'linux_arm64'
+  else
+    raise("Architecture '#{@host.architecture}' not supported by template #{template_name}")
+  end
 
-case @host.operatingsystem.family
-when 'Debian'
-  trivy_download_cmd = "wget -O /tmp/trivy.deb \"#{trivy_url}\""
-  grype_download_cmd = "wget -O /tmp/grype.deb \"#{grype_url}\""
-  trivy_install_cmd = "dpkg -i /tmp/trivy.deb"
-  grype_install_cmd = "dpkg -i /tmp/grype.deb"
-  trivy_cleanup_cmd = "rm -f /tmp/trivy.deb"
-  grype_cleanup_cmd = "rm -f /tmp/grype.deb"
-when 'Redhat', 'Suse'
-  trivy_install_cmd = "rpm -ivh \"#{trivy_url}\""
-  grype_install_cmd = "rpm -ivh \"#{grype_url}\""
+  trivy_url = "https://github.com/aquasecurity/trivy/releases/download/v#{trivy_version}/trivy_#{trivy_version}_#{trivy_arch}.#{pkg}"
+  grype_url = "https://github.com/anchore/grype/releases/download/v#{grype_version}/grype_#{grype_version}_#{grype_arch}.#{pkg}"
+
+  case os_family
+  when 'Debian'
+    install_steps = {
+      'trivy' => [
+        "wget -O /tmp/trivy.deb \"#{trivy_url}\"",
+        'dpkg -i /tmp/trivy.deb',
+        'rm -f /tmp/trivy.deb'
+      ],
+      'grype' => [
+        "wget -O /tmp/grype.deb \"#{grype_url}\"",
+        'dpkg -i /tmp/grype.deb',
+        'rm -f /tmp/grype.deb'
+      ]
+    }
+  when 'Redhat', 'Suse'
+    install_steps = {
+      'trivy' => ["rpm -ivh \"#{trivy_url}\""],
+      'grype' => ["rpm -ivh \"#{grype_url}\""]
+    }
+  end
 end
 -%>
-
-<% if input('scanner_to_install') == 'both' || input('scanner_to_install') == 'trivy' -%>
-<%= trivy_download_cmd unless trivy_install_cmd.nil? %>
-<%= trivy_install_cmd %>
-<%= trivy_cleanup_cmd unless trivy_cleanup_cmd.nil? %>
+<% unless install_from_github -%>
+<%= render_template('Package Action - Script Default', :action => 'install', :package => package_list) %>
+<% else -%>
+<% selected_scanners.each do |scanner| -%>
+<% install_steps[scanner].each do |step| -%>
+<%= step %>
+<% end -%>
+<% end -%>
 <% end -%>
-
-<% if input('scanner_to_install') == 'both' || input('scanner_to_install') == 'grype' -%>
-<%= grype_download_cmd unless grype_download_cmd.nil? %>
-<%= grype_install_cmd %>
-<%= grype_cleanup_cmd unless grype_cleanup_cmd.nil? %>
-<% end %>

data/config/routes.rb

@@ -6,6 +6,7 @@ Rails.application.routes.draw do
                      defaults: { apiv: 'v2' },
                      apiv: /v1|v2/,
                      constraints: ApiConstraints.new(version: 2, default: true) do
+      get 'cve_scans/latest_by_hosts', to: 'cve_scans#latest_by_hosts'
       constraints(host_id: %r{[^/]+}) do
         resources :hosts, only: [] do
           resources :cve_scans, only: %i[index show destroy] do

data/lib/foreman_cve_scanner/engine.rb

@@ -71,32 +71,41 @@ module ForemanCveScanner
     def self.register_settings(plugin)
       plugin.settings do
         category :foreman_cve_scanner, N_('CVE Scanner') do
-          setting 'preferred_cve_scanner',
-            type: :string,
-            default: 'trivy',
-            full_name: N_('Preferred CVE scanner'),
-            description: N_('Default scanner used by the Run CVE scan job template.')
-          setting 'run_cve_scan_after_host_profiles_upload',
-            type: :boolean,
-            default: false,
-            full_name: N_('Run CVE scan after host profiles upload'),
-            description: N_('When Katello is installed, schedule a CVE scan after a host profiles upload completes.')
-          setting 'cve_scan_delete_after_days',
-            type: :integer,
-            default: 90,
-            full_name: N_('Delete CVE scans after X days'),
-            description: N_(
-              'Delete CVE scans older than the configured number of days. ' \
-              'Set to 0 to disable automatic cleanup.'
-            )
+          ForemanCveScanner::Engine.register_cve_scanner_settings(self)
         end
       end
     end
 
+    def self.register_cve_scanner_settings(settings)
+      settings.setting 'preferred_cve_scanner',
+        type: :string,
+        default: 'trivy',
+        full_name: N_('Preferred CVE scanner'),
+        description: N_('Default scanner used by the Run CVE scan job template.')
+      settings.setting 'run_cve_scan_after_host_profiles_upload',
+        type: :boolean,
+        default: false,
+        full_name: N_('Run CVE scan after host profiles upload'),
+        description: N_('When Katello is installed, schedule a CVE scan after a host profiles upload completes.')
+      settings.setting 'enable_katello_cve_fix_availability',
+        type: :boolean,
+        default: true,
+        full_name: N_('Show CVE fix availability from content'),
+        description: N_('When Katello is installed, enrich the latest CVE scan with managed errata fix availability.')
+      settings.setting 'cve_scan_delete_after_days',
+        type: :integer,
+        default: 90,
+        full_name: N_('Delete CVE scans after X days'),
+        description: N_(
+          'Delete CVE scans older than the configured number of days. ' \
+          'Set to 0 to disable automatic cleanup.'
+        )
+    end
+
     def self.register_permissions(plugin)
       plugin.security_block :foreman_cve_scanner do
         permission :view_cve_scans,
-          { 'api/v2/cve_scans': %i[index latest show export compare] },
+          { 'api/v2/cve_scans': %i[index latest latest_by_hosts show export compare] },
           resource_type: 'Host'
         permission :import_cve_scans,
           { 'api/v2/cve_scans': %i[import] },

data/lib/foreman_cve_scanner/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ForemanCveScanner
-  VERSION = '0.6.1'
+  VERSION = '0.7.1'
 end

data/test/controllers/api/v2/cve_scans_controller_test.rb

@@ -7,10 +7,15 @@ module Api
     class CveScansControllerTest < ActionController::TestCase
       def setup
         @host = FactoryBot.create(:host)
+        @previous_retention = Setting[:cve_scan_delete_after_days]
         @scan_old = create_scan(created_at: 2.hours.ago, scanned_at: 2.hours.ago, total: 1, low: 1)
         @scan_new = create_scan(created_at: 1.hour.ago, scanned_at: 1.hour.ago, total: 2, high: 2)
       end
 
+      def teardown
+        Setting[:cve_scan_delete_after_days] = @previous_retention
+      end
+
       test 'index returns scans for host' do
         get :index, params: { host_id: @host.id }
         assert_response :success
@@ -26,6 +31,63 @@ module Api
         assert_equal @scan_new.id, body['id']
       end
 
+      test 'latest_by_hosts returns latest scan summary for each requested host' do
+        other_host = FactoryBot.create(:host)
+        other_scan = create_scan(
+          host: other_host,
+          created_at: 30.minutes.ago,
+          scanned_at: 30.minutes.ago,
+          total: 3,
+          medium: 3
+        )
+
+        get :latest_by_hosts, params: { host_ids: [@host.id, other_host.id] }
+
+        assert_response :success
+        body = ActiveSupport::JSON.decode(@response.body)
+        results = body['results'].index_by { |row| row['host_id'] }
+
+        assert_equal @scan_new.id, results[@host.id]['id']
+        assert_equal other_scan.id, results[other_host.id]['id']
+        assert_equal 2, results[@host.id]['total']
+        assert_equal 3, results[other_host.id]['total']
+      end
+
+      test 'latest_by_hosts ignores duplicate and unknown host ids' do
+        get :latest_by_hosts, params: { host_ids: [@host.id, @host.id, 'nope', 999_999] }
+
+        assert_response :success
+        body = ActiveSupport::JSON.decode(@response.body)
+
+        assert_equal 1, body['results'].size
+        assert_equal @host.id, body['results'][0]['host_id']
+        assert_equal @scan_new.id, body['results'][0]['id']
+      end
+
+      test 'latest_by_hosts omits requested hosts that have no scans' do
+        host_without_scan = FactoryBot.create(:host)
+
+        get :latest_by_hosts, params: { host_ids: [@host.id, host_without_scan.id] }
+
+        assert_response :success
+        body = ActiveSupport::JSON.decode(@response.body)
+
+        assert_equal 1, body['results'].size
+        assert_equal @host.id, body['results'][0]['host_id']
+        assert_equal @scan_new.id, body['results'][0]['id']
+      end
+
+      test 'latest_by_hosts returns empty results when requested hosts have no scans' do
+        ForemanCveScanner::CveScan.delete_all
+
+        get :latest_by_hosts, params: { host_ids: [@host.id] }
+
+        assert_response :success
+        body = ActiveSupport::JSON.decode(@response.body)
+
+        assert_empty body['results']
+      end
+
       test 'show returns scan by id' do
         get :show, params: { host_id: @host.id, id: @scan_old.id }
         assert_response :success
@@ -33,6 +95,14 @@ module Api
         assert_equal @scan_old.id, body['id']
       end
 
+      test 'show does not include fix availability data' do
+        get :show, params: { host_id: @host.id, id: @scan_old.id }
+
+        assert_response :success
+        body = ActiveSupport::JSON.decode(@response.body)
+        assert_not body['findings'].first.key?('katello_fix')
+      end
+
       test 'import imports external scan for host' do
         assert_difference('ForemanCveScanner::CveScan.count', 1) do
           post :import, params: {
@@ -47,6 +117,32 @@ module Api
         assert_equal 1, body['critical']
       end
 
+      test 'import refreshes cve host status' do
+        assert_difference('HostStatus::CveStatus.count', 1) do
+          post :import, params: {
+            host_id: @host.id,
+            cve_scan: create_payload,
+          }
+        end
+
+        assert_response :created
+        status = HostStatus::CveStatus.find_by(host: @host)
+        assert_equal HostStatus::CveStatus::CVE_SCANNER_STATUS_CRITICAL_HIGH, status.status
+      end
+
+      test 'import cleans up old scans for host using retention setting' do
+        Setting[:cve_scan_delete_after_days] = 1
+        old_scan = create_scan(scanned_at: 3.days.ago, created_at: 3.days.ago)
+
+        post :import, params: {
+          host_id: @host.id,
+          cve_scan: create_payload,
+        }
+
+        assert_response :created
+        assert_not ForemanCveScanner::CveScan.exists?(old_scan.id)
+      end
+
       test 'import rejects scan without scanned_at' do
         post :import, params: {
           host_id: @host.id,
@@ -236,7 +332,7 @@ module Api
         {
           scanner: 'custom-scanner',
           source: 'external',
-          scanned_at: '2026-05-14T08:00:00Z',
+          scanned_at: Time.current.iso8601,
           findings: [external_finding],
         }
       end

data/test/models/foreman_cve_scanner/host_extensions_test.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+require 'test_plugin_helper'
+
+module ForemanCveScanner
+  class HostExtensionsTest < ActiveSupport::TestCase
+    def setup
+      @host = FactoryBot.create(:host)
+      @other_host = FactoryBot.create(:host)
+    end
+
+    test 'cve_scanned finds hosts with or without scans' do
+      create_scan(host: @host)
+
+      assert_search_includes('cve_scanned = true', @host)
+      assert_search_excludes('cve_scanned = true', @other_host)
+      assert_search_includes('cve_scanned = false', @other_host)
+      assert_search_excludes('cve_scanned = false', @host)
+    end
+
+    test 'severity and total searches use latest scan only' do
+      create_scan(host: @host, scanned_at: 2.hours.ago, total: 7, critical: 1, high: 2, medium: 3, low: 1)
+      create_scan(host: @host, scanned_at: 1.hour.ago, total: 0)
+      create_scan(host: @other_host, total: 6, critical: 1, high: 1, medium: 2, low: 2)
+
+      %w[total critical high medium low].each do |column|
+        assert_search_includes("cve_#{column} > 0", @other_host)
+        assert_search_excludes("cve_#{column} > 0", @host)
+      end
+    end
+
+    test 'scanner and source searches use latest scan only' do
+      create_scan(host: @host, scanned_at: 2.hours.ago, scanner: 'trivy', source: 'rex')
+      create_scan(host: @host, scanned_at: 1.hour.ago, scanner: 'grype', source: 'external')
+      create_scan(host: @other_host, scanner: 'trivy', source: 'rex')
+
+      assert_search_includes('cve_scanner = trivy', @other_host)
+      assert_search_excludes('cve_scanner = trivy', @host)
+      assert_search_includes('cve_source = rex', @other_host)
+      assert_search_excludes('cve_source = rex', @host)
+    end
+
+    test 'scanned_at search uses latest scan only' do
+      cutoff = Time.zone.parse('2026-06-01 12:00:00')
+      create_scan(host: @host, scanned_at: cutoff - 1.day)
+      create_scan(host: @other_host, scanned_at: cutoff + 1.day)
+
+      assert_search_includes("cve_scanned_at > \"#{cutoff.iso8601}\"", @other_host)
+      assert_search_excludes("cve_scanned_at > \"#{cutoff.iso8601}\"", @host)
+    end
+
+    test 'rejects unsupported SQL operators' do
+      assert_raises ::ScopedSearch::QueryNotSupported do
+        ::Host::Managed.search_by_cve_total('cve_total', '>= 0) OR 1=1 --', '0')
+      end
+    end
+
+    private
+
+    def assert_search_includes(query, host)
+      assert_includes search_host_ids(query), host.id
+    end
+
+    def assert_search_excludes(query, host)
+      assert_not_includes search_host_ids(query), host.id
+    end
+
+    def search_host_ids(query)
+      ::Host::Managed.search_for(query).pluck(:id)
+    end
+
+    def create_scan(host:, scanned_at: Time.current, scanner: 'trivy', source: 'rex', **counts)
+      counts = { total: 0, critical: 0, high: 0, medium: 0, low: 0 }.merge(counts)
+
+      CveScan.create!(
+        host: host,
+        scanner: scanner,
+        source: source,
+        scanned_at: scanned_at,
+        raw: { 'dummy' => true },
+        summary: { 'worst' => CveScan.worst_severity(counts.transform_keys(&:to_s)) },
+        findings: counts[:total].zero? ? [] : [{ 'id' => 'CVE-0000-0000' }],
+        total: counts[:total],
+        critical: counts[:critical],
+        high: counts[:high],
+        medium: counts[:medium],
+        low: counts[:low]
+      )
+    end
+  end
+end

data/test/models/host_status/cve_status_test.rb

@@ -13,6 +13,7 @@ module HostStatus
       assert_equal 'No CVE scans', status.to_label
       assert_equal HostStatus::Global::WARN, status.to_global
       assert_equal 0, status.to_status
+      assert_not status.relevant?
     end
 
     test 'critical or high scan returns error status' do
@@ -51,6 +52,13 @@ module HostStatus
       assert_includes HostStatus.status_registry, HostStatus::CveStatus
     end
 
+    test 'persisted status is relevant without looking up latest scan' do
+      status = HostStatus::CveStatus.create!(host: @host, status: 0)
+      status.expects(:latest_scan).never
+
+      assert status.relevant?
+    end
+
     private
 
     def create_scan(critical:, high:, medium:, low:)

data/test/services/foreman_cve_scanner/cve_report_scanner_test.rb

@@ -22,7 +22,7 @@ module ForemanCveScanner
       data = JSON.parse(File.read(File.join(ForemanCveScanner::Engine.root, 'test/fixtures/trivy.json')))
       scanner = ForemanCveScanner::CveReportScanner.new('scan' => data)
       scanner.generate
-      assert_equal(10, scanner.logs.count)
+      assert_equal(trivy_vulnerability_count(data), scanner.logs.count)
       assert_equal('info', scanner.logs[0]['log']['level'])
       expected_message = [
         'CVE-2020-12762: json-c, libfastjson: integer overflow and out-of-',
@@ -36,7 +36,7 @@ module ForemanCveScanner
       data = JSON.parse(File.read(File.join(ForemanCveScanner::Engine.root, 'test/fixtures/grype.json')))
       scanner = ForemanCveScanner::CveReportScanner.new('scan' => data)
       scanner.generate
-      assert_equal(18, scanner.logs.count)
+      assert_equal(Array(data['matches']).size, scanner.logs.count)
       first_severity = data.dig('matches', 0, 'vulnerability', 'severity')
       expected_level = expected_level_for(first_severity)
       assert_equal scanner.logs[0]['log']['level'], expected_level
@@ -56,8 +56,92 @@ module ForemanCveScanner
       assert_equal 'unknown', ForemanCveScanner::CveReportScanner.detect_scanner('foo' => 'bar')
     end
 
+    test 'trivy scan keeps duplicate cves for different packages' do
+      data = {
+        'Results' => [
+          {
+            'Vulnerabilities' => [
+              {
+                'VulnerabilityID' => 'CVE-2026-0001',
+                'PkgName' => 'openssl',
+                'InstalledVersion' => '1.0',
+                'Title' => 'openssl issue',
+                'Severity' => 'HIGH',
+                'PrimaryURL' => 'https://example.com/openssl',
+              },
+              {
+                'VulnerabilityID' => 'CVE-2026-0001',
+                'PkgName' => 'curl',
+                'InstalledVersion' => '2.0',
+                'Title' => 'curl issue',
+                'Severity' => 'MEDIUM',
+                'PrimaryURL' => 'https://example.com/curl',
+              },
+            ],
+          },
+        ],
+      }
+
+      scanner = ForemanCveScanner::CveReportScanner.new('scan' => data)
+      finding_names = scanner.unified_vulnerabilities.map { |finding| finding['name'] }
+
+      assert_equal 2, scanner.unified_vulnerabilities.size
+      assert_equal %w[openssl curl], finding_names
+
+      scanner.generate
+
+      assert_equal 2, scanner.logs.count
+      assert_equal 1, scanner.metrics['high']
+      assert_equal 1, scanner.metrics['medium']
+      assert_equal 2, scanner.metrics['total']
+    end
+
+    test 'grype scan keeps duplicate cves for different packages' do
+      data = {
+        'matches' => [
+          {
+            'artifact' => { 'name' => 'openssl', 'version' => '1.0' },
+            'vulnerability' => {
+              'id' => 'CVE-2026-0002',
+              'description' => 'openssl issue',
+              'severity' => 'HIGH',
+              'dataSource' => 'https://example.com/openssl',
+            },
+          },
+          {
+            'artifact' => { 'name' => 'curl', 'version' => '2.0' },
+            'vulnerability' => {
+              'id' => 'CVE-2026-0002',
+              'description' => 'curl issue',
+              'severity' => 'LOW',
+              'dataSource' => 'https://example.com/curl',
+            },
+          },
+        ],
+      }
+
+      scanner = ForemanCveScanner::CveReportScanner.new('scan' => data)
+      finding_names = scanner.unified_vulnerabilities.map { |finding| finding['name'] }
+
+      assert_equal 2, scanner.unified_vulnerabilities.size
+      assert_equal %w[openssl curl], finding_names
+
+      scanner.generate
+
+      assert_equal 2, scanner.logs.count
+      assert_equal 1, scanner.metrics['high']
+      assert_equal 1, scanner.metrics['low']
+      assert_equal 2, scanner.metrics['total']
+    end
+
     private
 
+    def trivy_vulnerability_count(data)
+      Array(data['Results']).sum do |result|
+        Array(result['Vulnerabilities']).size
+      end
+    end
+
     def expected_level_for(severity)
       map = {
         'CRITICAL' => 'err',