Consult package vulnerabilities outside upload/download phase

Start by tracing the existing upload, download, and Scan/Task analysis entry points that consult package vulnerabilities. Review how permissions, task completion, and vulnerability results are exposed today. Done means a REST client can retrieve current vulnerabilities for a package without downloading it or requiring write permission to trigger a scan.

Context

Currently the 3 ways in which the vulnerabilities of a package can be consulted/verified are:

• Upload phase
• Download phase
• Scan/Task analysis

The Vulnerabilies Database in Trustify is always changing so a Non Vulnerable package can have Vulnerabilities tomorrow

Problem statement

A REST API client (e.g. UI app or similar) would like to know the vulnerabilities by which certain package is affected without downloading the package.

Current approach:

• Three steps:
  • Scan/Task package
  • Wait for the task to complete
  • Verify the vulnerabilities for the package

Limitations of the current approach:

• Trigger a Scan/Task requires a Write permissions while those who want to the package vulnerabilities might only need Read permissions
• The Three steps system described above, while easy to be executed manually, it brings its challenges when automated on the client side (e.g.)
  • The UI would need to continuously fetch data to know whether or not the Scan/Task has finished while at the same time anyone else could be triggering a new scan in parallel