Add SBOM, symbols, traces, and VEX files for CVE-2022-21661 SQLi case

- Created CycloneDX and SPDX SBOM files for both reachable and unreachable images.
- Added symbols.json detailing function entry and sink points in the WordPress code.
- Included runtime traces for function calls in both reachable and unreachable scenarios.
- Developed OpenVEX files indicating vulnerability status and justification for both cases.
- Updated README for evaluator harness to guide integration with scanner output.

src/Concelier/StellaOps.Concelier.WebService/Extensions/AdvisoryRawRequestMapper.cs

@@ -1,9 +1,10 @@
-using System.Collections.Immutable;
-using System.Text.Json;
-using StellaOps.Concelier.RawModels;
-using StellaOps.Concelier.WebService.Contracts;
-
-namespace StellaOps.Concelier.WebService.Extensions;
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using System.Text.Json;
+using StellaOps.Concelier.RawModels;
+using StellaOps.Concelier.WebService.Contracts;
+
+namespace StellaOps.Concelier.WebService.Extensions;
 
 internal static class AdvisoryRawRequestMapper
 {
@@ -14,13 +15,13 @@ internal static class AdvisoryRawRequestMapper
         ArgumentNullException.ThrowIfNull(timeProvider);
 
         var sourceRequest = request.Source ?? throw new ArgumentException("source section is required.", nameof(request));
-        var upstreamRequest = request.Upstream ?? throw new ArgumentException("upstream section is required.", nameof(request));
-        var contentRequest = request.Content ?? throw new ArgumentException("content section is required.", nameof(request));
-        var identifiersRequest = request.Identifiers ?? throw new ArgumentException("identifiers section is required.", nameof(request));
-
-        var source = new RawSourceMetadata(
-            sourceRequest.Vendor,
-            sourceRequest.Connector,
+        var upstreamRequest = request.Upstream ?? throw new ArgumentException("upstream section is required.", nameof(request));
+        var contentRequest = request.Content ?? throw new ArgumentException("content section is required.", nameof(request));
+        var identifiersRequest = request.Identifiers ?? throw new ArgumentException("identifiers section is required.", nameof(request));
+
+        var source = new RawSourceMetadata(
+            sourceRequest.Vendor,
+            sourceRequest.Connector,
             sourceRequest.Version,
             string.IsNullOrWhiteSpace(sourceRequest.Stream) ? null : sourceRequest.Stream);
 
@@ -33,22 +34,21 @@ internal static class AdvisoryRawRequestMapper
             string.IsNullOrWhiteSpace(signatureRequest.Certificate) ? null : signatureRequest.Certificate,
             string.IsNullOrWhiteSpace(signatureRequest.Digest) ? null : signatureRequest.Digest);
 
-        var retrievedAt = upstreamRequest.RetrievedAt ?? timeProvider.GetUtcNow();
-
-        var upstream = new RawUpstreamMetadata(
-            upstreamRequest.UpstreamId,
-            string.IsNullOrWhiteSpace(upstreamRequest.DocumentVersion) ? null : upstreamRequest.DocumentVersion,
-            retrievedAt,
-            upstreamRequest.ContentHash,
-            signature,
-            NormalizeDictionary(upstreamRequest.Provenance));
-
-        var rawContent = NormalizeRawContent(contentRequest.Raw);
-        var content = new RawContent(
-            contentRequest.Format,
-            string.IsNullOrWhiteSpace(contentRequest.SpecVersion) ? null : contentRequest.SpecVersion,
-            rawContent,
-            string.IsNullOrWhiteSpace(contentRequest.Encoding) ? null : contentRequest.Encoding);
+        var retrievedAt = upstreamRequest.RetrievedAt ?? timeProvider.GetUtcNow();
+        var upstream = new RawUpstreamMetadata(
+            upstreamRequest.UpstreamId,
+            string.IsNullOrWhiteSpace(upstreamRequest.DocumentVersion) ? null : upstreamRequest.DocumentVersion,
+            retrievedAt,
+            upstreamRequest.ContentHash,
+            signature,
+            NormalizeDictionary(upstreamRequest.Provenance));
+
+        var rawContent = NormalizeRawContent(contentRequest.Raw);
+        var content = new RawContent(
+            contentRequest.Format,
+            string.IsNullOrWhiteSpace(contentRequest.SpecVersion) ? null : contentRequest.SpecVersion,
+            rawContent,
+            string.IsNullOrWhiteSpace(contentRequest.Encoding) ? null : contentRequest.Encoding);
 
         var aliases = NormalizeStrings(identifiersRequest.Aliases);
         if (aliases.IsDefault)
@@ -56,11 +56,15 @@ internal static class AdvisoryRawRequestMapper
             aliases = ImmutableArray<string>.Empty;
         }
 
-        var identifiers = new RawIdentifiers(
-            aliases,
-            identifiersRequest.Primary);
-
-        var linksetRequest = request.Linkset;
+        var identifiers = new RawIdentifiers(
+            aliases,
+            identifiersRequest.Primary);
+        var advisoryKey = NormalizeAdvisoryKey(
+            identifiersRequest.Primary,
+            aliases,
+            upstreamRequest.UpstreamId);
+
+        var linksetRequest = request.Linkset;
         var linkset = new RawLinkset
         {
             Aliases = NormalizeStrings(linksetRequest?.Aliases),
@@ -71,6 +75,8 @@ internal static class AdvisoryRawRequestMapper
             Notes = NormalizeDictionary(linksetRequest?.Notes)
         };
 
+        var links = BuildLinks(advisoryKey, aliases, upstreamRequest.UpstreamId);
+
         return new AdvisoryRawDocument(
             tenant.Trim().ToLowerInvariant(),
             source,
@@ -78,8 +84,8 @@ internal static class AdvisoryRawRequestMapper
             content,
             identifiers,
             linkset,
-            AdvisoryKey: string.Empty,
-            Links: ImmutableArray<RawLink>.Empty);
+            AdvisoryKey: advisoryKey,
+            Links: links);
     }
 
     internal static ImmutableArray<string> NormalizeStrings(IEnumerable<string>? values)
@@ -124,11 +130,11 @@ internal static class AdvisoryRawRequestMapper
         return builder.ToImmutable();
     }
 
-    private static ImmutableArray<RawReference> NormalizeReferences(IEnumerable<AdvisoryLinksetReferenceRequest>? references)
-    {
-        if (references is null)
-        {
-            return ImmutableArray<RawReference>.Empty;
+    private static ImmutableArray<RawReference> NormalizeReferences(IEnumerable<AdvisoryLinksetReferenceRequest>? references)
+    {
+        if (references is null)
+        {
+            return ImmutableArray<RawReference>.Empty;
         }
 
         var builder = ImmutableArray.CreateBuilder<RawReference>();
@@ -150,10 +156,59 @@ internal static class AdvisoryRawRequestMapper
         return builder.Count == 0 ? ImmutableArray<RawReference>.Empty : builder.ToImmutable();
     }
 
-    private static JsonElement NormalizeRawContent(JsonElement element)
-    {
-        var json = element.ValueKind == JsonValueKind.Undefined ? "{}" : element.GetRawText();
-        using var document = JsonDocument.Parse(string.IsNullOrWhiteSpace(json) ? "{}" : json);
-        return document.RootElement.Clone();
-    }
-}
+    private static JsonElement NormalizeRawContent(JsonElement element)
+    {
+        var json = element.ValueKind == JsonValueKind.Undefined ? "{}" : element.GetRawText();
+        using var document = JsonDocument.Parse(string.IsNullOrWhiteSpace(json) ? "{}" : json);
+        return document.RootElement.Clone();
+    }
+
+    private static string NormalizeAdvisoryKey(string? primaryId, ImmutableArray<string> aliases, string upstreamId)
+    {
+        if (!string.IsNullOrWhiteSpace(primaryId))
+        {
+            return primaryId.Trim();
+        }
+
+        foreach (var alias in aliases)
+        {
+            if (!string.IsNullOrWhiteSpace(alias))
+            {
+                return alias.Trim();
+            }
+        }
+
+        return string.IsNullOrWhiteSpace(upstreamId) ? string.Empty : upstreamId.Trim();
+    }
+
+    private static ImmutableArray<RawLink> BuildLinks(string advisoryKey, ImmutableArray<string> aliases, string upstreamId)
+    {
+        var builder = ImmutableArray.CreateBuilder<RawLink>();
+        var seen = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+
+        void AddLink(string scheme, string? value)
+        {
+            if (string.IsNullOrWhiteSpace(value))
+            {
+                return;
+            }
+
+            var normalized = value.Trim();
+            var key = $"{scheme}:{normalized}";
+            if (seen.Add(key))
+            {
+                builder.Add(new RawLink(scheme, normalized));
+            }
+        }
+
+        AddLink("PRIMARY", advisoryKey);
+        foreach (var alias in aliases)
+        {
+            AddLink("ALIAS", alias);
+        }
+
+        AddLink("UPSTREAM", upstreamId);
+
+        return builder.Count == 0 ? ImmutableArray<RawLink>.Empty : builder.ToImmutable();
+    }
+}

src/Concelier/StellaOps.Concelier.WebService/Extensions/TelemetryExtensions.cs

@@ -10,10 +10,11 @@ using OpenTelemetry.Trace;
 using Serilog;
 using Serilog.Core;
 using Serilog.Events;
-using StellaOps.Concelier.Core.Jobs;
-using StellaOps.Concelier.Connector.Common.Telemetry;
-using StellaOps.Concelier.WebService.Diagnostics;
-using StellaOps.Concelier.WebService.Options;
+using StellaOps.Concelier.Core.Jobs;
+using StellaOps.Concelier.Connector.Common.Telemetry;
+using StellaOps.Concelier.WebService.Diagnostics;
+using StellaOps.Concelier.WebService.Options;
+using StellaOps.Ingestion.Telemetry;
 
 namespace StellaOps.Concelier.WebService.Extensions;
 
@@ -65,13 +66,14 @@ public static class TelemetryExtensions
 
         if (telemetry.EnableTracing)
         {
-            openTelemetry.WithTracing(tracing =>
-            {
-                tracing
-                    .AddSource(JobDiagnostics.ActivitySourceName)
-                    .AddSource(SourceDiagnostics.ActivitySourceName)
-                    .AddAspNetCoreInstrumentation()
-                    .AddHttpClientInstrumentation();
+            openTelemetry.WithTracing(tracing =>
+            {
+                tracing
+                    .AddSource(JobDiagnostics.ActivitySourceName)
+                    .AddSource(SourceDiagnostics.ActivitySourceName)
+                    .AddSource(IngestionTelemetry.ActivitySourceName)
+                    .AddAspNetCoreInstrumentation()
+                    .AddHttpClientInstrumentation();
 
                 ConfigureExporters(telemetry, tracing);
             });
@@ -84,7 +86,7 @@ public static class TelemetryExtensions
                 metrics
                     .AddMeter(JobDiagnostics.MeterName)
                     .AddMeter(SourceDiagnostics.MeterName)
-                    .AddMeter(IngestionMetrics.MeterName)
+                    .AddMeter(IngestionTelemetry.MeterName)
                     .AddMeter("StellaOps.Concelier.Connector.CertBund")
                     .AddMeter("StellaOps.Concelier.Connector.Nvd")
                     .AddMeter("StellaOps.Concelier.Connector.Vndr.Chromium")