feat(cve): match the CODESYS runtime against NVD by CPE (#180)

2026-07-16 20:10:18 +00:00
parent b7406eca15
commit 097f86243e
2 changed files with 296 additions and 1 deletions
@@ -601,7 +601,7 @@ impl PipelineOrchestrator {
                k.expose_secret().to_string()
            }),
        );
-        let alerts = match tokio::time::timeout(
+        let mut alerts = match tokio::time::timeout(
            std::time::Duration::from_secs(600),
            cve_scanner.scan_dependencies(target_id, &mut entries),
        )
@@ -617,6 +617,18 @@ impl PipelineOrchestrator {
                Vec::new()
            }
        };
+        // OSV can't match `pkg:codesys/*` (no such ecosystem); CODESYS advisories
+        // live in NVD keyed by CPE + runtime version. Add those (best-effort).
+        if let Ok(codesys) = tokio::time::timeout(
+            std::time::Duration::from_secs(120),
+            cve_scanner.scan_codesys(target_id, &mut entries),
+        )
+        .await
+        {
+            alerts.extend(codesys);
+        } else {
+            tracing::warn!(target_id, "CODESYS CVE match timed out");
+        }

        for entry in &entries {
            let filter = doc! {