There are 3 cases when the fixed version of each release is not stated in list files. Case 1 When the latest version in the release is greater th

loadAdvisories loads the advisories map from a file

mergeAdvisoriesEntries merges advisories by picking the latest version (with vendorID) for each arch+flavor. There may be multiple advisories that fix

parse parses all the advisories from Alma Linux.

Parse parses all the advisories from Alma Linux. It is exported for those who want to customize trivy-db.

parse parses all the advisories from Rocky Linux. It is exported for those who want to customize trivy-db.

parseAffected parses the affected fields cf. https://ossf.github.io/osv-schema/#affected-fields

parseAffectedVersions parses the affected.versions and affected.ranges fields cf. - https://ossf.github.io/osv-schema/#affectedversions-field - https:

parseDatabaseSpecific adds a version from the last_known_affected_version_range field cf. https://github.com/github/advisory-database/issues/470#issue

parseSeverityV3 parses a CVSSv3 vector string and returns the vector and score

parseSeverityV40 parses a CVSSv4.0 vector string and returns the vector and score

parseThreats extracts severities from "threats" in a CSAF VEX. cf. https://redhatproductsecurity.github.io/security-data-guidelines/csaf-vex/#general-

parseVulnerability retrieves CSAF VEX data for a specific vulnerability, extracts raw per-package entries, and then converts them into advisories.

removeVendorIDs removes VendorID from advisories + merges arches for advisories (by fixedVersion). This is needed to save space in OSS trivy-db. But A

resolveCPE resolves the CPE for a relates_to_product_reference.

resolveProduct resolves a ProductID to a Product using the pre-built maps.

saveAdvisories walks all key-values under the 'advisory-detail' bucket and copy them in each vendor's bucket.

selectLatestVersions selects the latest (highest) version per (arch, flavor)

SerializeAdvisories saves the current advisories map to a file

splitAdvisoriesByRanges splits advisories if there are multiple vulnerable version ranges e.g. VulnerableVersions: [">=1.0, <1.5", ">=2.0, <2.5"], Pat

reference: https://github.com/aquasecurity/trivy-db/blob/5c844be3ba6b9ef13df640857a10f8737e360feb/pkg/vulnsrc/redhat/redhat.go#L196-L217