feat(contrib/trivy): pass through Trivy's repository class to models.Package

[sadayuki-matsuno]

What did you implement:

trivy-to-vuls now carries Trivy's repository classification over to the scan result, as a new models.Package.RepositoryClass field holding "", "official" or "third-party".

Since v0.69.0 (#9932, designed in #9916) Trivy classifies deb packages as third-party from the Maintainer field and skips OS advisory matching for them; v0.70.0 (#10129) moved the skip into the common Detect path, covering rpm as well. In pkg/detector/ospkg/driver.DropThirdPartyPackages the skip takes no flag or option, and the only trace it leaves is a debug-level log line — so a user reading the report cannot see that a package was excluded. The fact does survive in the JSON, though, as Result.Packages[].Repository.Class.

The converter dropped that field and models.Package had no place to put it, so consumers of a converted scan result could not tell "no vulnerabilities found" from "never matched against advisories". This PR passes the mark through unchanged. It adds no detection, reporting or display logic; deciding what to do with a third-party package is left to the consumer.

Why a string and not a bool: Trivy has three states, and collapsing official into unset would keep consumers from acting only on an explicit third-party mark. As a string, an unknown future class value also survives the conversion.

Type of change

• New feature (non-breaking change which adds functionality)

How Has This Been Tested?

TestConvert in contrib/trivy/pkg/converter_test.go gains four table-driven cases:

• ClassOSPkg propagates Repository.Class to Package — third-party, official and unclassified packages in one result.
• duplicate packages, Repository.Class of the newer version wins and its reverse-order twin — with the duplicate OS packages that Trivy's dpkg analyzer produces, the kept entry must carry the class of the version that was kept, in either input order.
• ClassLangPkg ignores Repository.Class — library packages are out of scope, since only the rpm and dpkg analyzers set the field.

TestPackage_RepositoryClassOmitEmpty in models/packages_test.go pins the backward compatibility below.

CGO_ENABLED=0 GOEXPERIMENT=jsonv2 go test ./contrib/trivy/... ./models/...
CGO_ENABLED=0 GOEXPERIMENT=jsonv2 go vet ./contrib/trivy/... ./models/...
go mod tidy   # no diff

go test ./... is green locally except for the scanner tests that need the vulsio/integration fixtures, which I could not fetch; they fail in their own setup before reaching any assertion, and this change touches no code they exercise.

Backward compatibility

The JSON tag is repositoryClass,omitempty, so for any package without a class — every package from every scanner other than Trivy, and every Trivy result produced before v0.69.0 — the serialized bytes are unchanged. Readers of older scan result JSON get the zero value "", which is the same "unknown" state Trivy itself uses. No existing field changes meaning, and nothing in vuls reads the new field yet.

Scope

• OS packages only (Result.Class == os-pkgs). models.Library is untouched.
• Only the converter writes the field; other scanners leave it empty.

Checklist:

You don't have to satisfy all of the following.

• Write tests
• Write documentation
• Check that there aren't other open pull requests for the same issue/feature
• Format your source code by make fmt
• Pass the test by make test (see the note above: everything but the fixture-gated scanner tests)
• Provide verification config / commands
• Enable "Allow edits from maintainers" for this PR
• Update the messages below

Is this ready for review?: YES

Reference

• feat(dpkg): detect third-party packages using maintainer list aquasecurity/trivy#9916
• feat(vuln): skip vulnerability scanning for third-party packages in Debian/Ubuntu aquasecurity/trivy#9932
• feat(vuln): skip third-party packages in common Detect function aquasecurity/trivy#10129

🤖 Generated with Claude Code

[Copilot]

Copilot review overview

🔵 Needs a closer look

Document the required --list-all-pkgs workflow or provide another path for preserving classifications.

Review effort: Lite
Findings: None

What changed in this PR

Adds Trivy repository classification to converted OS package results while preserving backward-compatible JSON output.

Changes:

• Adds optional RepositoryClass to models.Package.
• Propagates Trivy classifications during OS package conversion.
• Adds conversion, deduplication, and serialization tests.

File	Description
models/​packages.go	Defines the package classification field.
models/​packages_test.go	Tests omission of empty classification values.
contrib/​trivy/​pkg/​converter.go	Copies Trivy repository classes into OS packages.
contrib/​trivy/​pkg/​converter_test.go	Tests propagation, deduplication, and scope.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[shino]

🎊