feat(extract/mitre/cve/v5): extract SSVC from CNA/ADP metrics

[MaineK00n]

What

Extract SSVC from MITRE CVE v5 records and record the CNA/ADP container role for every source label.

• New pkg/extract/types/data/ssvc type (Source, Role, Version, Options []{Key,Value}, Timestamp) with Sort()/Compare().
• Additive SSVC []ssvc.SSVC field on vulnerability/content.Content (Sort()/Compare() updated).
• extract/mitre/cve/v5 reads metric.other entries where type == "ssvc" from the CNA container and each ADP container, tagging every entry with its provider source label.
• The published content now carries an optional.container_types map (source label -> "CNA"/"ADP") so a consumer can tell which container any source label (in severity/cwe/references/ssvc/...) came from.

Example output:

"ssvc": [{
  "source": "CISA-ADP",
  "role": "CISA Coordinator",
  "version": "2.0.3",
  "options": [
    {"key": "Automatable", "value": "no"},
    {"key": "Exploitation", "value": "none"},
    {"key": "Technical Impact", "value": "total"}
  ],
  "timestamp": "2024-05-14T17:28:38.774982Z"
}],
"optional": {
  "container_types": { "CERT-In": "CNA", "CISA-ADP": "ADP" }
}

Why

Migrating from go-cve-dictionary to the vuls2 DB drops SSVC and per-container (CNA/ADP) source labels for enriched MITRE content (see future-architect/vuls#2586). Two gaps:

• SSVC was not extracted at all — the extractor only looked at the typed CVSS metrics and ignored metric.other.
• CNA/ADP role was not preserved. go-cve-dictionary recorded this with an explicit MitreContainer.ContainerType ("CNA"/"ADP") assigned from the container's structural position (containers.cna vs containers.adp[]) — never from a -ADP shortName suffix (which is only a CISA naming convention and is not schema-guaranteed). This PR reproduces that behavior structurally and exposes it via optional.container_types, leaving the shared source string fields untouched.

How

• Group CNA + ADP metrics by provider source (same pattern as Severity/CWE/References).
• For each other:ssvc metric, marshal/unmarshal the content into a focused struct and normalize each decision point to a {key, value} option. Timestamp parsed with RFC3339Nano.
• Build the container_types map from structural position while iterating the CNA/ADP containers.

Testing

• GOEXPERIMENT=jsonv2 go test ./... passes.
• Added Compare table tests for the new ssvc type.
• Regenerated golden files; diffs are limited to the new ssvc blocks and the optional.container_types map on the published CVEs (the REJECTED fixture is unchanged).

Note

vulnerability/content.Content is imported by vuls2 and filter-vuls-data-extracted-redhat. The new SSVC field is additive (backward-compatible) and the container role is carried in the existing Optional map, so no shared source types change. Surfacing SSVC / CNA-ADP end-to-end in the vuls2 DB still requires the vuls2 unified content type to consume these fields (future-architect/vuls#2586) — this change only makes them available in the extracted dataset.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds support for carrying SSVC decision data and container role provenance (CNA vs ADP) through the MITRE CVE v5 extraction pipeline, so downstream consumers can preserve SSVC and distinguish per-container source labels when migrating to vuls2 DB.

Changes:

• Model SSVC as a first-class extracted type (pkg/extract/types/data/ssvc) and add an SSVC []ssvc.SSVC field to vulnerability/content.Content with deterministic Sort()/Compare().
• Extend the MITRE CVE v5 extractor to read metric.other entries where type == "ssvc" from CNA + ADP containers and emit them tagged with the provider source label.
• Publish an optional.container_types map (source label → "CNA"/"ADP") and update golden outputs accordingly.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
pkg/fetch/mitre/cve/v5/types.go	Switch some extension/other.content fields to jsontext.Value to retain raw JSON values.
pkg/extract/types/data/vulnerability/content/content.go	Add SSVC field and include it in Sort()/Compare() for deterministic output.
pkg/extract/types/data/ssvc/ssvc.go	Introduce SSVC schema type plus Sort()/Compare() for stable ordering.
pkg/extract/types/data/ssvc/ssvc_test.go	Unit tests for SSVC Compare.
pkg/extract/mitre/cve/v5/v5.go	Extract SSVC from metric.other and add optional.container_types; refactor severity parsing.
pkg/extract/mitre/cve/v5/testdata/golden/data/2024/CVE-2024-6958.json	Golden updated to include optional.container_types.
pkg/extract/mitre/cve/v5/testdata/golden/data/2024/CVE-2024-4232.json	Golden updated to include ssvc block and optional.container_types.
pkg/extract/mitre/cve/v5/testdata/golden/data/2024/CVE-2024-39565.json	Golden updated to include ssvc block and optional.container_types.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.

[shino]

🌼