up

samples/linkset/lnm-22-002/README.md

@@ -0,0 +1,7 @@
+# SAMPLES-LNM-22-002 fixtures
+
+Excititor VEX observations demonstrating conflicting statuses for the same product/vulnerability.
+- `vex-observations.ndjson` — three providers: not_affected (component_not_present), under_investigation, and affected.
+- Includes linkset references and disagreements for downstream correlation.
+
+Determinism: ordered by createdAt; hashes are placeholders; UTC timestamps.

samples/linkset/lnm-22-002/vex-observations.ndjson

@@ -0,0 +1,3 @@
+{"tenant":"demo","providerId":"exc-supplier-a","observationId":"vex-obs-0001","vulnerabilityId":"CVE-2025-3000","productKey":"pkg:deb/demo/app@1.0.0","status":"not_affected","justification":"component_not_present","evidenceHash":"sha256:ddd444","createdAt":"2025-11-10T00:00:00Z","linkset":{"purls":["pkg:deb/demo/app@1.0.0"],"references":[{"type":"advisory","url":"https://example.com/advisory-3000"}]}}
+{"tenant":"demo","providerId":"exc-supplier-b","observationId":"vex-obs-0002","vulnerabilityId":"CVE-2025-3000","productKey":"pkg:deb/demo/app@1.0.0","status":"under_investigation","justification":null,"evidenceHash":"sha256:eee555","createdAt":"2025-11-11T00:00:00Z","linkset":{"purls":["pkg:deb/demo/app@1.0.0"],"references":[{"type":"cve","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3000"}]}}
+{"tenant":"demo","providerId":"exc-supplier-c","observationId":"vex-obs-0003","vulnerabilityId":"CVE-2025-3000","productKey":"pkg:deb/demo/app@1.0.0","status":"affected","justification":null,"evidenceHash":"sha256:fff666","createdAt":"2025-11-12T00:00:00Z","linkset":{"purls":["pkg:deb/demo/app@1.0.0"],"references":[{"type":"vendor","url":"https://vendor.example.com/notice"}],"disagreements":[{"providerId":"exc-supplier-a","status":"not_affected"}]}}