24 lines
1.6 KiB
Markdown
24 lines
1.6 KiB
Markdown
# AGENTS
|
|
## Role
|
|
Optional exporter producing vuln-list-shaped JSON tree for downstream trivy-db builder or interoperability. Deterministic, provenance-preserving.
|
|
## Scope
|
|
- Transform canonical advisories into directory tree structure mirroring aquasecurity/vuln-list (by ecosystem/vendor/distro as applicable).
|
|
- Sorting and serialization invariants: stable key order, newline policy, UTC ISO-8601.
|
|
- Cursoring/incremental export: export_state tracks last advisory hash/time to avoid full rewrites.
|
|
- Packaging: output directory under exports/json/<timestamp> with reproducible naming; optionally symlink latest.
|
|
- Optional auxiliary index files (for example severity summaries) may be generated when explicitly requested, but must remain deterministic and avoid altering canonical payloads.
|
|
## Participants
|
|
- Storage.Mongo.AdvisoryStore as input; ExportState repository for cursors/digests.
|
|
- Core scheduler runs JsonExportJob; Plugin DI wires JsonExporter + job.
|
|
- TrivyDb exporter may consume the rendered tree in v0 (builder path) if configured.
|
|
## Interfaces & contracts
|
|
- Job kind: export:json (JsonExportJob).
|
|
- Determinism: same inputs -> identical file bytes; hash snapshot persisted.
|
|
- Provenance: include minimal provenance fields when helpful; keep identity stable.
|
|
## In/Out of scope
|
|
In: JSON rendering and layout; incremental/deterministic writes.
|
|
Out: ORAS push and Trivy DB BoltDB writing (owned by Trivy exporter).
|
|
## Observability & security expectations
|
|
- Metrics: export.json.records, bytes, duration, delta.changed.
|
|
- Logs: target path, record counts, digest; no sensitive data.
|