Description

Adds a new DataSource field to storage.EmbeddedVulnerability. This datasource will be used to uniquely associate data with CVEs in Central.

The initial use cases will track CVE fixed dates.

The DataSource will only be populated by Scanner V4 and only for vulnerabilities NOT sourced from Red Hat (because more fields are needed to uniquely identify a Red Hat vulnerability then what is exposed by Scanner V4).

The DataSource field will contain the concatenation of the updater name from Scanner V4/ClairCore + the package os/version (if applicable), examples:

debian-bookworm-updater::debian:12
alpine-main-v3.23-updater::alpine:3.23
osv/go
osv/maven

This is not an ideal solution and adds an uncomfortable reliance on the updater names and Central. To help with this:

• unit tests and e2e tests have been created that check for changes to the updaters and will fail if attention is needed.
• The field will be treated as opaque, it will not be serialized in API responses and will be cleared from storage.EmbeddedVulnerability at the datastore layer as part of ROX-30641
  • This PR added json:"-" to the new field which will omit it from REST API responses, however it is still populated in gRPC reponses until cleared at the datastore level.

The scanner/e2etests were not starting prior this PR - the restart check was removed because the scanner pod was always restarting at least once before bundles were loaded. After removing the restart check the e2etest now run, however the existing TestImage fails due to data differences - this is unrelated to the new TestUpdaterNames that runs successfully (see here).

User-facing documentation

• CHANGELOG.md is updated OR update is not needed
• documentation PR is created and is linked above OR is not needed

Testing and quality

• the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
• CI results are inspected

Automated testing

• added unit tests
• added e2e tests
• modified existing tests

There is slight overlap between the added unit and e2e tests that check to see if updaters have been changed. The unit tests will cover the obvious changes to updater sets, but cannot validate the actual updater names since those are determined at run time. The actual updater names are evaluated as part of the e2e tests.

How I validated my change

Because the dataSource field is not filtered yet for gRPC requests - I used roxctl (gRPC) to verify that the field is being populated as expected, the below jq queries show the counts / values of .scan.components[].vulns[].datasource for various images

$ rctl image scan --image=datadog/agent -f 2>/dev/null | jq '.scan.components[] | select(.vulns | length > 0) | .vulns[] | [.datasource] | @tsv' -r | sort | uniq -c

   4 osv/go
   2 osv/pypi
  38 ubuntu/updater/noble::ubuntu:24.04

$ rctl image scan --image=node -f 2>/dev/null | jq '.scan.components[] | select(.vulns | length > 0) | .vulns[] | [.datasource] | @tsv' -r | sort | uniq -c

1947 debian/updater::debian:12
   3 osv/npm

$ rctl image scan --image=nginx -f 2>/dev/null | jq '.scan.components[] | select(.vulns | length > 0) | .vulns[] | [.datasource] | @tsv' -r | sort | uniq -c

 122 debian/updater::debian:13

$ rctl image scan --image=grafana/grafana -f 2>/dev/null | jq '.scan.components[] | select(.vulns | length > 0) | .vulns[] | [.datasource] | @tsv' -r | sort | uniq -c

   8 osv/go

$ rctl image scan --image=alpine:3.19.7 -f 2>/dev/null | jq '.scan.components[] | select(.vulns | length > 0) | .vulns[] | [.datasource] | @tsv' -r | sort | uniq -c

  10 alpine-main-v3.19-updater::alpine:3.19

Additionally, ran the new e2e tests against an already running instances of StackRox

$ go test -run ^TestUpdaterNames$ github.com/stackrox/rox/scanner/e2etests -v
=== RUN   TestUpdaterNames
    updater_names_test.go:91: Querying updaters
{"level":"debug","count":105,"time":"2026-01-09T17:13:34-06:00","message":"found updaters"}
    updater_names_test.go:96: Found 105 updaters in database
--- PASS: TestUpdaterNames (0.57s)
PASS
ok  	github.com/stackrox/rox/scanner/e2etests	1.971s

For good measure, modified one of the patterns in the test to prove failure (removed the x from rhel-vex:

$ go test -run ^TestUpdaterNames$ github.com/stackrox/rox/scanner/e2etests -v
=== RUN   TestUpdaterNames
    updater_names_test.go:91: Querying updaters
{"level":"debug","count":105,"time":"2026-01-09T17:14:46-06:00","message":"found updaters"}
    updater_names_test.go:96: Found 105 updaters in database
    updater_names_test.go:114: 
        	Error Trace:	/Users/dcaravel/dev/stackrox/stackrox-add-datasource-to-vulns/scanner/e2etests/updater_names_test.go:114
        	Error:      	Should be true
        	Test:       	TestUpdaterNames
        	Messages:   	Unknown updater name: "rhel-vex"
--- FAIL: TestUpdaterNames (0.57s)
FAIL
FAIL	github.com/stackrox/rox/scanner/e2etests	1.956s
FAIL