Rule Format

Rule Format

Builder генерує один уніфікований ruleset format.

Top-Level Shape

{
  "version": "2026-05-13T19:24:59Z",
  "generated_at": "2026-05-13T19:24:59Z",
  "ttl": 3600,
  "rules": []
}

Rule Shape

{
  "id": "CVE-2026-41205",
  "platform": "ubuntu",
  "release": "jammy",
  "check_type": "package_version",
  "operator": "lt",
  "value": "1.1.3+ds1-2ubuntu0.2",
  "code": 12345,
  "message": "Host package mako is vulnerable to CVE-2026-41205",
  "package_name": "mako",
  "severity": "medium",
  "references": [
    "https://www.cve.org/CVERecord?id=CVE-2026-41205"
  ],
  "source": "canonical-ubuntu-cves",
  "match_mode": "version",
  "rule_status": "fixed",
  "fixed_version": "1.1.3+ds1-2ubuntu0.2",
  "updated_at": "2026-05-13T19:24:59Z"
}

Check Types

• package_version — звичайний package version check.
• kernel_version — Ubuntu-style kernel ABI/version check.
• kernel_package_version — Debian kernel package version check.

Match Modes

match_mode	rule_status	Meaning
version	fixed	Є published fixed version; agent робить comparator-based перевірку.
advisory	vulnerable	Vendor still marks release/package/kernel track vulnerable; precise fixed cutoff відсутній.
advisory	pending	Fix line tracked, але published fixed version ще не доступний для precise matching.

Практично:

• match_mode = "version" дає precise applicability verdict.
• match_mode = "advisory" дає unresolved/unfixed signal.
• --fixed-only відсікає advisory matches.