@groupby/ai-dev 0.5.16 → 0.5.17

package/teams/firstspirit-caas/skills/handle-red-cve-plan/scripts/parse_json_report.py

@@ -0,0 +1,183 @@
+#!/usr/bin/env python3
+"""Extract active OWASP Dependency-Check findings with CVSS >= 7.0 from the
+JSON report (`dependency-check-report.json`).
+
+Usage: parse_json_report.py <dependency-check-report.json> [--out <path>]
+Emits the same worklist schema as parse_report.py (the HTML fallback): a
+`findings` list and an `unparsed` hard-stop list. Prints JSON to stdout (or
+--out). Exits non-zero with a one-line stderr error on failure.
+
+Active vs suppressed is structural here, not inferred: a dependency's
+`vulnerabilities` array holds active findings; `suppressedVulnerabilities`
+holds the suppressed ones and is never read.
+"""
+import argparse
+import json
+import re
+import sys
+
+THRESHOLD = 7.0
+_CVE_ID = re.compile(r'^CVE-\d{4}-\d+$')
+_HIGH_BANDS = {"CRITICAL", "HIGH"}
+
+
+def _severity_for_score(score: float) -> str:
+    if score >= 9.0:
+        return "CRITICAL"
+    if score >= 7.0:
+        return "HIGH"
+    if score >= 4.0:
+        return "MEDIUM"
+    return "LOW"
+
+
+def _numeric_score(vuln: dict):
+    """The worst numeric base score across the CVSS versions the report
+    carries (v2 `score`, v3/v4 `baseScore`), or None when none is present.
+    Taking the max keeps a >=7 score in any one version from being gated
+    below by a lower score in another."""
+    scores = []
+    for key, field in (("cvssv3", "baseScore"), ("cvssv4", "baseScore"), ("cvssv2", "score")):
+        obj = vuln.get(key)
+        if isinstance(obj, dict) and isinstance(obj.get(field), (int, float)):
+            scores.append(float(obj[field]))
+    return round(max(scores), 1) if scores else None
+
+
+def _score_and_severity(vuln: dict):
+    """(score, severity): a numeric CVSS wins (severity derived from it);
+    else the qualitative `severity` band; else (None, None)."""
+    score = _numeric_score(vuln)
+    if score is not None:
+        return score, _severity_for_score(score)
+    band = vuln.get("severity")
+    if band:
+        return None, band.upper()
+    return None, None
+
+
+def _affected_versions(vuln: dict) -> list:
+    out = []
+    for entry in vuln.get("vulnerableSoftware", []):
+        sw = entry.get("software", {})
+        cpe = sw.get("id")
+        if not cpe:
+            continue
+        bounds = []
+        if sw.get("versionStartIncluding"):
+            bounds.append(f">= {sw['versionStartIncluding']}")
+        if sw.get("versionStartExcluding"):
+            bounds.append(f"> {sw['versionStartExcluding']}")
+        if sw.get("versionEndIncluding"):
+            bounds.append(f"<= {sw['versionEndIncluding']}")
+        if sw.get("versionEndExcluding"):
+            bounds.append(f"< {sw['versionEndExcluding']}")
+        out.append(f"{cpe} versions {', '.join(bounds)}" if bounds else cpe)
+    return list(dict.fromkeys(out))
+
+
+def _dependency_fields(dep: dict):
+    packages = dep.get("packages") or []
+    pkgurl = packages[0].get("id") if packages else None
+    return dep.get("fileName", ""), pkgurl, dep.get("sha1")
+
+
+def parse(report: dict) -> dict:
+    findings = []
+    unparsed = []
+    seen = set()
+    seen_unparsed = set()
+    for dep in report.get("dependencies", []):
+        file_name, pkgurl, sha1 = _dependency_fields(dep)
+        included_by = [ref["reference"] for ref in dep.get("includedBy", [])
+                       if ref.get("reference")]
+        for vuln in dep.get("vulnerabilities", []):
+            advisory_id = vuln.get("name")
+            if not advisory_id:
+                continue
+            score, severity = _score_and_severity(vuln)
+
+            if score is None and severity is None:
+                _add_unparsed(unparsed, seen_unparsed, advisory_id, file_name, pkgurl, sha1,
+                              "no CVSS score or severity band could be parsed")
+                continue
+
+            if score is not None:
+                if score < THRESHOLD:
+                    continue
+            elif severity not in _HIGH_BANDS:
+                continue
+
+            if not _CVE_ID.match(advisory_id):
+                _add_unparsed(unparsed, seen_unparsed, advisory_id, file_name, pkgurl, sha1,
+                              "non-CVE advisory id at/above CVSS 7.0 (not remediated by this skill)")
+                continue
+
+            key = (advisory_id, file_name)
+            if key in seen:
+                continue
+            seen.add(key)
+            references = list(dict.fromkeys(
+                r["url"] for r in vuln.get("references", [])
+                if r.get("url") and r["url"] != "#"))
+            findings.append({
+                "cveId": advisory_id,
+                "score": score,
+                "severity": severity,
+                "dependency": {
+                    "fileName": file_name,
+                    "packageUrl": pkgurl or None,
+                    "sha1": sha1 or None,
+                },
+                "description": vuln.get("description"),
+                "references": references,
+                "affectedVersions": _affected_versions(vuln),
+                "includedBy": included_by,
+            })
+    return {"findings": findings, "unparsed": unparsed}
+
+
+def _add_unparsed(unparsed, seen, advisory_id, file_name, pkgurl, sha1, reason):
+    key = (advisory_id, file_name)
+    if key in seen:
+        return
+    seen.add(key)
+    unparsed.append({
+        "cveId": advisory_id,
+        "fileName": file_name,
+        "packageUrl": pkgurl or None,
+        "sha1": sha1 or None,
+        "reason": reason,
+    })
+
+
+def main(argv):
+    ap = argparse.ArgumentParser()
+    ap.add_argument("report")
+    ap.add_argument("--out")
+    ns = ap.parse_args(argv)
+    try:
+        with open(ns.report, encoding="utf-8") as fh:
+            report = json.load(fh)
+    except OSError as exc:
+        print(f"parse_json_report.py: cannot read report: {exc}", file=sys.stderr)
+        return 1
+    except json.JSONDecodeError as exc:
+        print(f"parse_json_report.py: report is not valid JSON: {exc}", file=sys.stderr)
+        return 1
+    data = parse(report)
+    text = json.dumps(data, ensure_ascii=False, indent=2)
+    if ns.out:
+        try:
+            with open(ns.out, "w", encoding="utf-8") as fh:
+                fh.write(text)
+        except OSError as exc:
+            print(f"parse_json_report.py: cannot write output: {exc}", file=sys.stderr)
+            return 1
+    else:
+        print(text)
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))

package/teams/firstspirit-caas/skills/handle-red-cve-plan/scripts/parse_report.py

@@ -0,0 +1,255 @@
+#!/usr/bin/env python3
+"""Extract active OWASP Dependency-Check findings with CVSS >= 7.0 from the
+HTML report Bamboo publishes.
+
+Usage: parse_report.py <dependency-check-report.html> [--out <path>]
+Active findings are those with a per-CVE "suppress" button; already-suppressed
+entries have no button and are skipped. Prints JSON to stdout (or --out).
+Exits non-zero with a one-line stderr error on failure.
+"""
+import argparse
+import html as _html
+import json
+import re
+import sys
+
+THRESHOLD = 7.0
+
+# Match the full <button ...> start tag for a suppress button. `[^>]*` (not
+# `.*`) bounds the match so it can never cross a `>` into a neighboring tag --
+# one button's attributes can never bleed into another's. The id value is
+# matched loosely so buttons of every kind are captured here and classified by
+# `data-type-to-suppress` below; the match stage never decides what is a
+# finding. Attribute order is NOT assumed: each data-* attribute is pulled out
+# of the matched tag text separately by _ATTR below, so a differently-ordered
+# real report can't silently drop a finding.
+_BUTTON_TAG = re.compile(
+    r'<button\b[^>]*data-id-to-suppress="[^"]+"[^>]*>'
+)
+_CVE_ID = re.compile(r'^CVE-\d{4}-\d+$')
+_ATTR = re.compile(r'(data-[a-zA-Z0-9-]+)="([^"]*)"')
+
+# dependency-check's htmlReport.vsl emits three kinds of suppress button
+# (verified against the template):
+#   data-type-to-suppress="cpe"              -> a per-dependency IDENTIFIER
+#       button, rendered for every dependency's CPE regardless of whether it
+#       has any vulnerability. Ubiquitous and benign -- it never reddens the
+#       build, so it must be ignored, not treated as a finding.
+#   data-type-to-suppress="cve"              -> a CVE vulnerability.
+#   data-type-to-suppress="vulnerabilityName"-> a non-CVE vulnerability (GHSA,
+#       NPM advisory, RETIRE, etc.). The id may still be CVE-shaped.
+# Every non-CPE button is classified by SEVERITY (below), not by type:
+# below-HIGH findings are excluded, at/above-HIGH CVEs become findings, and
+# at/above-HIGH non-CVEs go to `unparsed` (a hard stop -- real but not
+# remediable by this skill).
+_IDENTIFIER_TYPES = {"cpe"}
+_ID_MARKER = re.compile(r'data-id-to-suppress=')
+_SCORE = re.compile(r'Base Score:\s*(?P<sev>CRITICAL|HIGH|MEDIUM|LOW)\s*\((?P<score>[\d.]+)\)')
+# Fallback for a bare CVSS score line with no "Base Score:" prefix, e.g. the
+# CVSSv2 rendering `CVSSv2: Score: 7.5 (AV:N/AC:L/...)`. Only used when the
+# primary _SCORE regex above finds nothing -- never overrides a match.
+_SCORE_FALLBACK = re.compile(r'\bScore:\s*(?P<score>[\d.]+)')
+# JS/NPM (and some other) advisories carry NO numeric CVSS -- dependency-check
+# renders them as `Unscored: Severity: medium`. The qualitative band still
+# tells us whether the finding is at/above HIGH, so it must NOT be treated as
+# "score undeterminable". Consulted only when both numeric regexes miss.
+_QUAL_SEVERITY = re.compile(r'(?:Unscored:\s*)?Severity:\s*(?P<band>CRITICAL|HIGH|MEDIUM|LOW|NONE)', re.I)
+_HIGH_BANDS = {"CRITICAL", "HIGH"}
+
+# The report already carries the advisory context needed to decide a fix:
+# the prose description (often naming fixed/affected versions), the advisory
+# reference URLs, and the "Vulnerable Software & Versions" ranges. Capturing
+# these lets the skill consult the report FIRST and web-search only for what
+# the report doesn't contain.
+_PRE = re.compile(r'<pre[^>]*>(.*?)</pre>', re.S)
+_ANCHOR = re.compile(r'<a\b[^>]*?href="([^"]+)"[^>]*>(.*?)</a>', re.S)
+
+
+def _clean(fragment: str) -> str:
+    """Strip tags, unescape entities, collapse whitespace."""
+    return re.sub(r"\s+", " ", _html.unescape(re.sub(r"<[^>]+>", " ", fragment))).strip()
+
+
+def _context(raw_block: str) -> tuple:
+    """Pull (description, references, affectedVersions) out of one finding's
+    raw HTML block. Missing pieces come back as None / []."""
+    pre = _PRE.search(raw_block)
+    description = _clean(pre.group(1)) if pre else None
+
+    ref_start = raw_block.find("References:")
+    vs_start = raw_block.find("Vulnerable Software")
+
+    references = []
+    if ref_start != -1:
+        ref_end = vs_start if vs_start != -1 else len(raw_block)
+        for href, _text in _ANCHOR.findall(raw_block[ref_start:ref_end]):
+            href = _html.unescape(href)
+            if href and href != "#":
+                references.append(href)
+
+    affected = []
+    if vs_start != -1:
+        for _href, text in _ANCHOR.findall(raw_block[vs_start:]):
+            t = _clean(text)
+            if t.startswith("cpe:") or "version" in t:
+                affected.append(t)
+
+    # De-dupe, preserve order.
+    references = list(dict.fromkeys(references))
+    affected = list(dict.fromkeys(affected))
+    return description, references, affected
+
+
+def _severity_for_score(score: float) -> str:
+    if score >= 9.0:
+        return "CRITICAL"
+    if score >= 7.0:
+        return "HIGH"
+    if score >= 4.0:
+        return "MEDIUM"
+    return "LOW"
+
+
+def _score_and_severity(tail: str):
+    """Classify a finding block's severity. Returns (score, severity):
+      - (float, band)  -- a numeric CVSS score was found.
+      - (None, band)   -- no number, but an explicit qualitative band
+                          ('Unscored: Severity: medium').
+      - (None, None)   -- nothing determinable (genuine fail-safe case).
+    Numeric score always wins; the qualitative band is a last resort."""
+    sm = _SCORE.search(tail)
+    if sm:
+        return float(sm.group("score")), sm.group("sev")
+    fm = _SCORE_FALLBACK.search(tail)
+    if fm:
+        score = float(fm.group("score"))
+        return score, _severity_for_score(score)
+    qm = _QUAL_SEVERITY.search(tail)
+    if qm:
+        return None, qm.group("band").upper()
+    return None, None
+
+
+def parse(html_text: str) -> dict:
+    findings = []
+    unparsed = []
+    seen = set()
+    seen_unparsed = set()
+    for bm in _BUTTON_TAG.finditer(html_text):
+        attrs = dict(_ATTR.findall(bm.group(0)))
+        advisory_id = attrs.get("data-id-to-suppress")
+        if not advisory_id:
+            continue
+        dep = attrs.get("data-display-name", "")
+        sha1 = attrs.get("data-sha1")
+        pkgurl = attrs.get("data-pkgurl")
+        suppress_type = attrs.get("data-type-to-suppress", "").lower()
+
+        # Identifier (CPE) suppress buttons appear on every dependency and do
+        # NOT redden the build -- skip them. Match on the type attribute, and
+        # fall back to the id shape when the attribute is absent (a bare
+        # `cpe:...` id is never a vulnerability).
+        if suppress_type in _IDENTIFIER_TYPES or advisory_id.startswith("cpe:"):
+            continue
+
+        # Search the whole current finding block: from the end of this
+        # button up to the start of the NEXT suppress button (or EOF). A
+        # fixed-size lookahead window would let a long description push the
+        # score line out of range and silently drop the finding.
+        nm = _ID_MARKER.search(html_text, bm.end())
+        block_end = nm.start() if nm else len(html_text)
+        raw_block = html_text[bm.end():block_end]
+        tail = _html.unescape(re.sub(r"<[^>]+>", " ", raw_block))
+
+        score, severity = _score_and_severity(tail)
+
+        if score is None and severity is None:
+            # Fail-safe: an active (suppress-button) finding whose severity
+            # could be determined neither numerically nor qualitatively must
+            # NEVER be silently dropped -- surface it so a human/verify-step
+            # investigates instead of quietly converging to "0 findings".
+            _add_unparsed(unparsed, seen_unparsed, advisory_id, dep, pkgurl, sha1,
+                          "no CVSS score or severity band could be parsed")
+            continue
+
+        # Below-HIGH findings (numeric < 7.0, or a low/medium/none qualitative
+        # band) do not reach the CVSS>=7.0 gate that reddens the build -- they
+        # are out of this skill's scope and are excluded, not surfaced.
+        if score is not None:
+            if score < THRESHOLD:
+                continue
+        elif severity not in _HIGH_BANDS:
+            continue
+
+        # At/above HIGH from here on.
+        if not _CVE_ID.match(advisory_id):
+            # Real, high-severity, but no CVE id (e.g. a HIGH/CRITICAL GHSA or
+            # NPM advisory): this skill only remediates CVEs, so it cannot fix
+            # it -- route to `unparsed` (a hard stop) rather than converge to
+            # "0 findings" on a build that is red because of it.
+            _add_unparsed(unparsed, seen_unparsed, advisory_id, dep, pkgurl, sha1,
+                          "non-CVE advisory id at/above CVSS 7.0 (not remediated by this skill)")
+            continue
+
+        key = (advisory_id, dep)
+        if key in seen:
+            continue
+        seen.add(key)
+        description, references, affected = _context(raw_block)
+        findings.append({
+            "cveId": advisory_id,
+            "score": score,
+            "severity": severity,
+            "dependency": {
+                "fileName": dep,
+                "packageUrl": pkgurl or None,
+                "sha1": sha1 or None,
+            },
+            "description": description,
+            "references": references,
+            "affectedVersions": affected,
+        })
+    return {"findings": findings, "unparsed": unparsed}
+
+
+def _add_unparsed(unparsed, seen, advisory_id, dep, pkgurl, sha1, reason):
+    """Append one deduplicated unparsed entry (same (id, file) never twice)."""
+    key = (advisory_id, dep)
+    if key in seen:
+        return
+    seen.add(key)
+    unparsed.append({
+        "cveId": advisory_id,
+        "fileName": dep,
+        "packageUrl": pkgurl or None,
+        "sha1": sha1 or None,
+        "reason": reason,
+    })
+
+
+def main(argv):
+    ap = argparse.ArgumentParser()
+    ap.add_argument("report")
+    ap.add_argument("--out")
+    ns = ap.parse_args(argv)
+    try:
+        with open(ns.report, encoding="utf-8") as fh:
+            data = parse(fh.read())
+    except OSError as exc:
+        print(f"parse_report.py: cannot read report: {exc}", file=sys.stderr)
+        return 1
+    text = json.dumps(data, ensure_ascii=False, indent=2)
+    if ns.out:
+        try:
+            with open(ns.out, "w", encoding="utf-8") as fh:
+                fh.write(text)
+        except OSError as exc:
+            print(f"parse_report.py: cannot write output: {exc}", file=sys.stderr)
+            return 1
+    else:
+        print(text)
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))

package/teams/firstspirit-caas/skills/handle-red-cve-plan/scripts/test_gen_suppression.py

@@ -0,0 +1,171 @@
+"""Run: python3 plugins/planetexpress/skills/handle-red-cve-plan/scripts/test_gen_suppression.py"""
+import contextlib
+import datetime
+import importlib.util
+import io
+import os
+import unittest
+
+_here = os.path.dirname(os.path.abspath(__file__))
+_spec = importlib.util.spec_from_file_location(
+    "gen_suppression", os.path.join(_here, "gen_suppression.py"))
+_mod = importlib.util.module_from_spec(_spec)
+_spec.loader.exec_module(_mod)
+
+PKG = "pkg:maven/org.apache.httpcomponents/httpcore@4.4.16"
+
+
+class TestGen(unittest.TestCase):
+    def test_pkgurl_to_regex(self):
+        self.assertEqual(
+            _mod.pkgurl_to_regex(PKG),
+            r"pkg:maven/org\.apache\.httpcomponents/httpcore@.*")
+
+    def test_temporary_has_until(self):
+        block = _mod.suppress_block(PKG, ["CVE-2026-54399"], "note", until="2026-09-13")
+        self.assertIn('<suppress until="2026-09-13Z">', block)
+        self.assertIn("<cve>CVE-2026-54399</cve>", block)
+        self.assertIn(r'regex="true">pkg:maven/org\.apache\.httpcomponents/httpcore@.*<', block)
+        self.assertIn("<![CDATA[note]]>", block)
+
+    def test_permanent_omits_until(self):
+        block = _mod.suppress_block(PKG, ["CVE-1"], "fp", until=None)
+        self.assertIn("<suppress>", block)
+        self.assertNotIn("until=", block)
+
+    def test_multiple_cves(self):
+        block = _mod.suppress_block(PKG, ["CVE-1", "CVE-2"], "n", until=None)
+        self.assertIn("<cve>CVE-1</cve>", block)
+        self.assertIn("<cve>CVE-2</cve>", block)
+
+    def test_default_until_two_months(self):
+        self.assertEqual(_mod.default_until(datetime.date(2026, 7, 13)), "2026-09-13")
+
+    # -- One suppression per CVE across multiple affected artifacts --------
+
+    def test_multiple_package_urls_in_one_block(self):
+        """The same CVE affecting several declared artifacts is suppressed
+        ONCE, in a single block that lists every affected packageUrl -- not a
+        separate block per artifact."""
+        pkgs = [
+            "pkg:maven/org.apache.httpcomponents/httpcore@4.4.16",
+            "pkg:maven/org.apache.httpcomponents.core5/httpcore5@5.4.2",
+        ]
+        block = _mod.suppress_block(pkgs, ["CVE-2026-54399", "CVE-2026-54428"], "n", until="2026-09-13")
+        self.assertEqual(block.count("<suppress"), 1)
+        self.assertEqual(block.count("<packageUrl"), 2)
+        self.assertIn(r'httpcomponents/httpcore@.*<', block)
+        self.assertIn(r'httpcomponents\.core5/httpcore5@.*<', block)
+        # Each CVE appears exactly once, in this single block.
+        self.assertEqual(block.count("<cve>CVE-2026-54399</cve>"), 1)
+        self.assertEqual(block.count("<cve>CVE-2026-54428</cve>"), 1)
+
+    def test_single_pkgurl_string_still_supported(self):
+        block = _mod.suppress_block(PKG, ["CVE-1"], "n", until=None)
+        self.assertEqual(block.count("<packageUrl"), 1)
+
+    # -- Fix-3: CDATA safety in notes -------------------------------------
+
+    def test_notes_with_cdata_close_sequence_is_escaped(self):
+        """A `]]>` inside notes must not be embedded raw -- that sequence
+        closes a CDATA section early and would corrupt the XML (any XML
+        after it stops being escaped, potentially breaking the document or,
+        worse, being interpreted as XML)."""
+        notes = "before ]]> after"
+        block = _mod.suppress_block(PKG, ["CVE-1"], notes, until=None)
+        self.assertNotIn("before ]]> after", block)
+        self.assertIn("before ]]]]><![CDATA[> after", block)
+        # The only unescaped "]]>" left must be the CDATA section's own close.
+        self.assertEqual(block.count("]]>"), block.count("<![CDATA["))
+
+
+    # -- Long notes are wrapped onto their own lines ----------------------
+
+    def test_long_notes_are_wrapped_multiline(self):
+        notes = (
+            "CVE-2026-54399 / CVE-2026-54428 are Apache HttpComponents Core 5.x findings "
+            "(advisory: 5.4.2 and earlier, 5.5-beta1 and earlier). The flagged artifact is "
+            "httpcore 4.4.16 (transitive via jersey-apache-connector), the final 4.x release "
+            "with no further 4.x fix. Over-match of the NVD CPE range onto the 4.x artifact."
+        )
+        block = _mod.suppress_block(PKG, ["CVE-2026-54399"], notes, until="2026-09-13")
+        cdata = block.split("<![CDATA[", 1)[1].split("]]>", 1)[0]
+        self.assertIn("\n", cdata)  # laid out over multiple lines
+        # CVE ids and version strings are never split across a line break.
+        for token in ("CVE-2026-54399", "CVE-2026-54428", "5.5-beta1"):
+            self.assertIn(token, cdata)
+            self.assertNotIn("\n".join(token.split("-")), cdata)
+
+    def test_short_notes_stay_inline(self):
+        block = _mod.suppress_block(PKG, ["CVE-1"], "short note", until=None)
+        self.assertIn("<notes><![CDATA[short note]]></notes>", block)
+
+    def test_caller_newlines_preserved_as_paragraphs(self):
+        block = _mod.suppress_block(PKG, ["CVE-1"], "line one\nline two", until=None)
+        cdata = block.split("<![CDATA[", 1)[1].split("]]>", 1)[0]
+        self.assertIn("line one", cdata)
+        self.assertIn("line two", cdata)
+        self.assertIn("\n", cdata)
+
+
+class TestPkgurlToRegexNoDeadCode(unittest.TestCase):
+    # -- Fix-4: dead-code cleanup regression guard ------------------------
+
+    def test_pkgurl_to_regex_still_matches_unchanged(self):
+        """re.escape() doesn't escape `/` or `:` on Python >= 3.7, so the
+        old .replace(r"\\/","/").replace(r"\\:",":") calls were no-ops.
+        Removing them must not change behaviour."""
+        self.assertEqual(
+            _mod.pkgurl_to_regex(PKG),
+            r"pkg:maven/org\.apache\.httpcomponents/httpcore@.*")
+
+
+class TestCli(unittest.TestCase):
+    # -- Fix-2: CLI must default to TEMPORARY, not permanent -------------
+
+    def _run(self, argv):
+        out = io.StringIO()
+        with contextlib.redirect_stdout(out):
+            rc = _mod.main(argv)
+        return rc, out.getvalue()
+
+    def test_no_until_no_permanent_defaults_to_temporary(self):
+        rc, out = self._run(["--pkgurl", PKG, "--cve", "CVE-2026-1", "--notes", "n"])
+        self.assertEqual(rc, 0)
+        self.assertIn('until="', out)
+
+    def test_permanent_flag_omits_until(self):
+        rc, out = self._run(
+            ["--pkgurl", PKG, "--cve", "CVE-2026-1", "--notes", "fp", "--permanent"])
+        self.assertEqual(rc, 0)
+        self.assertIn("<suppress>", out)
+        self.assertNotIn("until=", out)
+
+    def test_explicit_until_is_used(self):
+        rc, out = self._run(
+            ["--pkgurl", PKG, "--cve", "CVE-2026-1", "--notes", "n", "--until", "2026-09-13"])
+        self.assertEqual(rc, 0)
+        self.assertIn('until="2026-09-13Z"', out)
+
+    def test_repeated_pkgurl_yields_one_block_many_packageurls(self):
+        rc, out = self._run([
+            "--pkgurl", "pkg:maven/g/a@1", "--pkgurl", "pkg:maven/g/b@2",
+            "--cve", "CVE-2026-1", "--notes", "n",
+        ])
+        self.assertEqual(rc, 0)
+        self.assertEqual(out.count("<suppress"), 1)
+        self.assertEqual(out.count("<packageUrl"), 2)
+
+    def test_permanent_and_until_together_is_an_error(self):
+        stderr = io.StringIO()
+        with contextlib.redirect_stderr(stderr):
+            with self.assertRaises(SystemExit) as cm:
+                self._run([
+                    "--pkgurl", PKG, "--cve", "CVE-2026-1", "--notes", "n",
+                    "--permanent", "--until", "2026-09-13",
+                ])
+        self.assertEqual(cm.exception.code, 2)
+
+
+if __name__ == "__main__":
+    unittest.main()