| 1 | -- Reporting (src/advisories.rs): a repository's security advisories, and |
| 2 | -- the vulnerability reports people send its maintainers privately. |
| 3 | |
| 4 | -- An advisory: what the repository says about a vulnerability in what it |
| 5 | -- ships. Drafts are the maintainers'; published ones anyone who can see |
| 6 | -- the repository reads. |
| 7 | -- state: draft | published | withdrawn |
| 8 | -- severity: critical | high | medium | low |
| 9 | -- credits: JSON array of strings |
| 10 | CREATE TABLE advisories ( |
| 11 | id TEXT PRIMARY KEY, |
| 12 | g1tsa_id TEXT NOT NULL UNIQUE, |
| 13 | repo_id TEXT NOT NULL, |
| 14 | title TEXT NOT NULL, |
| 15 | description TEXT NOT NULL DEFAULT '', |
| 16 | severity TEXT NOT NULL, |
| 17 | cvss_vector TEXT, |
| 18 | cvss_score REAL, |
| 19 | cve_id TEXT, |
| 20 | ecosystem TEXT, |
| 21 | package TEXT, |
| 22 | affected_versions TEXT, |
| 23 | patched_versions TEXT, |
| 24 | state TEXT NOT NULL DEFAULT 'draft', |
| 25 | credits TEXT NOT NULL DEFAULT '[]', |
| 26 | report_id TEXT, |
| 27 | created_by TEXT NOT NULL, |
| 28 | created_at TEXT NOT NULL, |
| 29 | updated_at TEXT NOT NULL, |
| 30 | published_at TEXT, |
| 31 | withdrawn_at TEXT |
| 32 | ); |
| 33 | CREATE INDEX advisories_repo ON advisories (repo_id, state, created_at); |
| 34 | |
| 35 | -- A report: what someone told the maintainers privately, when the |
| 36 | -- repository takes private vulnerability reports. The reporter is a |
| 37 | -- username when signed in, else the address they gave; reporter_key is |
| 38 | -- either, lowercased, for the limit on how many one person files a day. |
| 39 | -- state: new | accepted | declined |
| 40 | CREATE TABLE vulnerability_reports ( |
| 41 | id TEXT PRIMARY KEY, |
| 42 | repo_id TEXT NOT NULL, |
| 43 | reporter TEXT, |
| 44 | reporter_email TEXT, |
| 45 | reporter_key TEXT NOT NULL, |
| 46 | title TEXT NOT NULL, |
| 47 | description TEXT NOT NULL, |
| 48 | severity TEXT, |
| 49 | state TEXT NOT NULL DEFAULT 'new', |
| 50 | advisory_id TEXT, |
| 51 | created_at TEXT NOT NULL, |
| 52 | reviewed_by TEXT, |
| 53 | reviewed_at TEXT, |
| 54 | review_note TEXT |
| 55 | ); |
| 56 | CREATE INDEX vulnerability_reports_repo ON vulnerability_reports (repo_id, state, created_at); |
| 57 | CREATE INDEX vulnerability_reports_reporter ON vulnerability_reports (repo_id, reporter_key, created_at); |