From e26c3340d6f577af12eed1743227d3f04a27bacb Mon Sep 17 00:00:00 2001 From: Ronny Grobel Date: Fri, 13 Nov 2026 08:29:20 +0100 Subject: [PATCH] Dateien nach "sql" hochladen --- sql/schema.sql | 219 ++++++++----------------------------------------- 1 file changed, 33 insertions(+), 186 deletions(-) diff --git a/sql/schema.sql b/sql/schema.sql index 61bfa6d..87e4434 100644 --- a/sql/schema.sql +++ b/sql/schema.sql @@ -1,248 +1,95 @@ - PRAGMA foreign_keys = ON; --- ========================================================= --- Vulnerability SQLite Database --- Schema Version: 3 --- ========================================================= - --- ========================================================= --- 1. METADATA --- ========================================================= - +-- New master schema, version 3. Not an in-place migration. CREATE TABLE IF NOT EXISTS meta ( - key TEXT PRIMARY KEY, + key TEXT PRIMARY KEY, value TEXT NOT NULL ); -INSERT INTO meta (key, value) -VALUES ('schema_version', '3') -ON CONFLICT(key) DO NOTHING; - - --- ========================================================= --- 2. DATA SOURCES / LAST UPDATE / IMPORT STATUS --- ========================================================= - CREATE TABLE IF NOT EXISTS sources ( name TEXT PRIMARY KEY, - revision TEXT NOT NULL DEFAULT '', - - indexed INTEGER NOT NULL DEFAULT 0 - CHECK (indexed IN (0, 1)), - - documents INTEGER NOT NULL DEFAULT 0 - CHECK (documents >= 0), - + indexed INTEGER NOT NULL DEFAULT 0 CHECK(indexed IN (0,1)), + documents INTEGER NOT NULL DEFAULT 0 CHECK(documents >= 0), last_sync TEXT, last_import TEXT, - import_status TEXT NOT NULL DEFAULT 'pending' - CHECK ( - import_status IN ( - 'pending', - 'success', - 'unsupported', - 'failed' - ) - ), - - import_errors INTEGER NOT NULL DEFAULT 0 - CHECK (import_errors >= 0) + CHECK(import_status IN ('pending','success','unsupported','failed')), + import_errors INTEGER NOT NULL DEFAULT 0 CHECK(import_errors >= 0) ); - -CREATE INDEX IF NOT EXISTS idx_sources_status - ON sources(import_status); - - --- ========================================================= --- 3. VULNERABILITIES --- ========================================================= +CREATE INDEX IF NOT EXISTS idx_sources_status ON sources(import_status); CREATE TABLE IF NOT EXISTS vulnerabilities ( id TEXT PRIMARY KEY, - published TEXT, modified TEXT, - state TEXT, summary TEXT ); - -CREATE INDEX IF NOT EXISTS idx_vulnerabilities_modified - ON vulnerabilities(modified); - - --- ========================================================= --- 4. ALIASES --- ========================================================= +CREATE INDEX IF NOT EXISTS idx_vulnerabilities_modified ON vulnerabilities(modified); CREATE TABLE IF NOT EXISTS aliases ( alias TEXT NOT NULL, - - vulnerability_id TEXT NOT NULL - REFERENCES vulnerabilities(id) - ON DELETE CASCADE, - - PRIMARY KEY ( - alias, - vulnerability_id - ) + vulnerability_id TEXT NOT NULL REFERENCES vulnerabilities(id) ON DELETE CASCADE, + PRIMARY KEY(alias,vulnerability_id) ); - -CREATE INDEX IF NOT EXISTS idx_aliases_vuln - ON aliases(vulnerability_id); - - --- ========================================================= --- 5. AFFECTED PACKAGES (OSV) --- ========================================================= +CREATE INDEX IF NOT EXISTS idx_aliases_vuln ON aliases(vulnerability_id); CREATE TABLE IF NOT EXISTS affected_packages ( id TEXT PRIMARY KEY, - - vulnerability_id TEXT NOT NULL - REFERENCES vulnerabilities(id) - ON DELETE CASCADE, - + vulnerability_id TEXT NOT NULL REFERENCES vulnerabilities(id) ON DELETE CASCADE, ecosystem TEXT, package_name TEXT, - ranges_json TEXT NOT NULL, versions_json TEXT NOT NULL, - source TEXT NOT NULL ); +CREATE INDEX IF NOT EXISTS idx_affected_vuln ON affected_packages(vulnerability_id); +CREATE INDEX IF NOT EXISTS idx_affected_package ON affected_packages(ecosystem,package_name); -CREATE INDEX IF NOT EXISTS idx_affected_vuln - ON affected_packages(vulnerability_id); - -CREATE INDEX IF NOT EXISTS idx_affected_package - ON affected_packages(ecosystem, package_name); - - --- ========================================================= --- 6. CPE CONDITION TREES (NVD) --- ========================================================= - +-- NVD condition tree: match semantics are not flattened. CREATE TABLE IF NOT EXISTS cpe_nodes ( id TEXT PRIMARY KEY, - - vulnerability_id TEXT NOT NULL - REFERENCES vulnerabilities(id) - ON DELETE CASCADE, - - parent_id TEXT - REFERENCES cpe_nodes(id), - - operator TEXT NOT NULL - CHECK (operator IN ('AND', 'OR')), - - negate INTEGER NOT NULL DEFAULT 0 - CHECK (negate IN (0, 1)), - + vulnerability_id TEXT NOT NULL REFERENCES vulnerabilities(id) ON DELETE CASCADE, + parent_id TEXT REFERENCES cpe_nodes(id) DEFERRABLE INITIALLY DEFERRED, + operator TEXT NOT NULL CHECK(operator IN ('AND','OR')), + negate INTEGER NOT NULL DEFAULT 0 CHECK(negate IN (0,1)), source TEXT NOT NULL ); - -CREATE INDEX IF NOT EXISTS idx_cpe_nodes_vuln - ON cpe_nodes(vulnerability_id); - -CREATE INDEX IF NOT EXISTS idx_cpe_nodes_parent - ON cpe_nodes(parent_id); - - --- ========================================================= --- 7. CPE MATCHES (NVD) --- ========================================================= +CREATE INDEX IF NOT EXISTS idx_cpe_nodes_vuln ON cpe_nodes(vulnerability_id); +CREATE INDEX IF NOT EXISTS idx_cpe_nodes_parent ON cpe_nodes(parent_id); CREATE TABLE IF NOT EXISTS cpe_matches ( id TEXT PRIMARY KEY, - - vulnerability_id TEXT NOT NULL - REFERENCES vulnerabilities(id) - ON DELETE CASCADE, - - node_id TEXT - REFERENCES cpe_nodes(id), - + vulnerability_id TEXT NOT NULL REFERENCES vulnerabilities(id) ON DELETE CASCADE, + node_id TEXT REFERENCES cpe_nodes(id) DEFERRABLE INITIALLY DEFERRED, criteria TEXT, - - vulnerable INTEGER - CHECK (vulnerable IN (0, 1)), - + vulnerable INTEGER CHECK(vulnerable IN (0,1)), version_start_including TEXT, version_start_excluding TEXT, - version_end_including TEXT, version_end_excluding TEXT, - source TEXT NOT NULL ); +CREATE INDEX IF NOT EXISTS idx_cpe_vuln ON cpe_matches(vulnerability_id); +CREATE INDEX IF NOT EXISTS idx_cpe_matches_node ON cpe_matches(node_id); +CREATE INDEX IF NOT EXISTS idx_cpe_matches_criteria ON cpe_matches(criteria); -CREATE INDEX IF NOT EXISTS idx_cpe_vuln - ON cpe_matches(vulnerability_id); - -CREATE INDEX IF NOT EXISTS idx_cpe_matches_node - ON cpe_matches(node_id); - -CREATE INDEX IF NOT EXISTS idx_cpe_matches_criteria - ON cpe_matches(criteria); - --- IMPORTANT: --- AND / OR / negate conditions must be evaluated as a tree. --- They must not be converted into independent vulnerability --- assertions, because that can produce false positives. - - --- ========================================================= --- 8. RED HAT CSAF ADVISORIES --- ========================================================= - +-- Product IDs and remediation semantics stay intact. CREATE TABLE IF NOT EXISTS redhat_advisories ( id TEXT PRIMARY KEY, - title TEXT, - initial_release_date TEXT, current_release_date TEXT, - product_tree_json TEXT NOT NULL ); - - --- ========================================================= --- 9. RED HAT CSAF CVE RELATIONSHIPS --- ========================================================= - CREATE TABLE IF NOT EXISTS redhat_advisory_cves ( id TEXT PRIMARY KEY, - - advisory_id TEXT NOT NULL - REFERENCES redhat_advisories(id) - ON DELETE CASCADE, - - cve_id TEXT NOT NULL - REFERENCES vulnerabilities(id) - ON DELETE CASCADE, - + advisory_id TEXT NOT NULL REFERENCES redhat_advisories(id) ON DELETE CASCADE, + cve_id TEXT NOT NULL REFERENCES vulnerabilities(id) ON DELETE CASCADE, product_status_json TEXT NOT NULL, remediations_json TEXT NOT NULL, - - UNIQUE ( - advisory_id, - cve_id - ) + UNIQUE(advisory_id,cve_id) ); - -CREATE INDEX IF NOT EXISTS idx_redhat_advisory_cves_cve - ON redhat_advisory_cves(cve_id); - -CREATE INDEX IF NOT EXISTS idx_redhat_advisory_cves_advisory - ON redhat_advisory_cves(advisory_id); - - --- ========================================================= --- END OF SCHEMA VERSION 3 --- ========================================================= - +CREATE INDEX IF NOT EXISTS idx_redhat_advisory_cves_cve ON redhat_advisory_cves(cve_id); +CREATE INDEX IF NOT EXISTS idx_redhat_advisory_cves_advisory ON redhat_advisory_cves(advisory_id);