feat(detector): detect Seal Security patched library packages (#2596)

* feat(detector): detect Seal Security patched library packages

Trivy v0.71.0 introduced vendor-specific advisory detection for
libraries (aquasecurity/trivy#10297), which routes packages patched by
Seal Security (e.g. @seal-security/ejs, seal-django) to dedicated
advisory buckets such as "seal npm::" in trivy-db.

The vendor matchers are registered via a side-effect import of
pkg/detector/library/all, which trivy itself does in pkg/scan/langpkg.
Import it in detector so that library.NewDriver picks up the vendor
routing and vuls report can detect CVEs for Seal-patched packages found
in lockfiles.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test(scanner): add Seal Security lockfile fixtures to golden test and make diff

Add the seal/* lockfiles introduced in vulsio/integration#42 to the
AnalyzeLibrary golden test and to the LIBS servers used by make diff /
diff-redis / diff-rdb-redis (server entries seal-npm/seal-pip/seal-gomod
were added to int-config.toml in the same integration PR).

The CI integration checkout is pinned to the integration PR head for
now; re-pin to the vulsio/integration main SHA once #42 is merged,
together with the submodule pointer bump.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* chore: bump integration submodule to the seal lockfiles commit

The test workflow checks out vulsio/integration at the SHA pinned in
test.yml, so the committed submodule gitlink must match that pin or
"go mod tidy && git diff --exit-code" fails on the dirty submodule.
Point both at the vulsio/integration#42 head; re-pin both to the
merged main SHA once that PR lands.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* chore: re-pin integration test data to the merged vulsio/integration main

vulsio/integration#42 is merged; point both the CI checkout pin and the
submodule gitlink at the squash-merged main commit instead of the PR
head.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs(detector): clarify the vendor registration import comment

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: shino

.github/workflows/test.yml

@@ -26,7 +26,7 @@ jobs:
       uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
         repository: vulsio/integration
-        ref: 9b7a17582cd4f4521f71fe64757c7397a47a36c3
+        ref: f1e643c892c9b2445a1a87c7b9cc56647bc40184
         path: integration
         persist-credentials: false
     - name: Set up Go 1.x

GNUmakefile

@@ -91,7 +91,7 @@ NOW=$(shell date '+%Y-%m-%dT%H-%M-%S%z')
 NOW_JSON_DIR := '${BASE_DIR}/$(NOW)'
 ONE_SEC_AFTER=$(shell date -d '+1 second' '+%Y-%m-%dT%H-%M-%S%z')
 ONE_SEC_AFTER_JSON_DIR := '${BASE_DIR}/$(ONE_SEC_AFTER)'
-LIBS := 'bundler' 'dart' 'elixir' 'pip' 'pipenv' 'poetry-v1' 'poetry-v2' 'pylock' 'uv' 'composer' 'composer-vendor-pear' 'composer-vendor-packagist' 'npm-v1' 'npm-v2' 'npm-v3' 'yarn' 'pnpm' 'pnpm-v9' 'bun' 'cargo' 'gomod' 'gosum' 'gobinary' 'jar' 'jar-wrong-name-log4j-core' 'war' 'pom' 'gradle' 'nuget-lock' 'nuget-config' 'dotnet-deps' 'dotnet-package-props' 'conan-v1' 'conan-v2' 'swift-cocoapods' 'swift-swift' 'rust-binary'
+LIBS := 'bundler' 'dart' 'elixir' 'pip' 'pipenv' 'poetry-v1' 'poetry-v2' 'pylock' 'uv' 'composer' 'composer-vendor-pear' 'composer-vendor-packagist' 'npm-v1' 'npm-v2' 'npm-v3' 'yarn' 'pnpm' 'pnpm-v9' 'bun' 'cargo' 'gomod' 'gosum' 'gobinary' 'jar' 'jar-wrong-name-log4j-core' 'war' 'pom' 'gradle' 'nuget-lock' 'nuget-config' 'dotnet-deps' 'dotnet-package-props' 'conan-v1' 'conan-v2' 'swift-cocoapods' 'swift-swift' 'rust-binary' 'seal-npm' 'seal-pip' 'seal-gomod'
 
 diff:
 	# git clone git@github.com:vulsio/vulsctl.git

detector/library.go

@@ -17,6 +17,12 @@ import (
 	"github.com/aquasecurity/trivy/pkg/db"
 	"github.com/aquasecurity/trivy/pkg/dependency/parser/java/jar"
 	"github.com/aquasecurity/trivy/pkg/detector/library"
+
+	// Register vendor-specific advisory matchers (e.g. Seal Security) so
+	// that drivers created by library.NewDriver route vendor-patched
+	// packages to their vendor advisory buckets, as trivy does in
+	// pkg/scan/langpkg.
+	_ "github.com/aquasecurity/trivy/pkg/detector/library/all"
 	ftypes "github.com/aquasecurity/trivy/pkg/fanal/types"
 	"github.com/aquasecurity/trivy/pkg/log"
 	"github.com/aquasecurity/trivy/pkg/purl"

integration

@@ -88,6 +88,13 @@ var lockfiles = []lockfileEntry{
 	// Swift
 	{"Podfile.lock", 0644, false},
 	{"Package.resolved", 0644, false},
+
+	// Seal Security patched packages (mixed with standard packages;
+	// detection via the "seal <eco>::" trivy-db buckets happens at report
+	// time, here we only pin the parsed package names/versions)
+	{"seal/package-lock.json", 0644, false},
+	{"seal/requirements.txt", 0644, false},
+	{"seal/go.mod", 0644, false},
 }
 
 // goldenFileName converts a lockfile path to a golden file name.

scanner/analyze_golden_test.go

@@ -0,0 +1,23 @@
+[
+  {
+    "type": "gomod",
+    "lockfilePath": "seal/go.mod",
+    "libs": [
+      {
+        "name": "example.com/seal-demo-app",
+        "version": "",
+        "purl": "pkg:golang/example.com/seal-demo-app",
+        "id": "example.com/seal-demo-app",
+        "dependsOn": [
+          "sealsecurity.io/golang.org/x/crypto@v0.26.0-sp1"
+        ]
+      },
+      {
+        "name": "sealsecurity.io/golang.org/x/crypto",
+        "version": "v0.26.0-sp1",
+        "purl": "pkg:golang/sealsecurity.io/golang.org/x/crypto@v0.26.0-sp1",
+        "id": "sealsecurity.io/golang.org/x/crypto@v0.26.0-sp1"
+      }
+    ]
+  }
+]

scanner/testdata/golden/seal_go.mod.json

@@ -0,0 +1,18 @@
+[
+  {
+    "type": "pip",
+    "lockfilePath": "seal/requirements.txt",
+    "libs": [
+      {
+        "name": "requests",
+        "version": "2.32.3",
+        "purl": "pkg:pypi/requests@2.32.3"
+      },
+      {
+        "name": "seal-django",
+        "version": "3.2.18+sp1",
+        "purl": "pkg:pypi/seal-django@3.2.18%2Bsp1"
+      }
+    ]
+  }
+]