make-report.py

#!/usr/bin/env python3
"""Generate a self-contained HTML report from a grype JSON scan.

One report describes ONE state of a system: the CVEs grype found in the SBOM
it was given. Each row is one CVE (or GHSA); multiple packages affected by the
same CVE are grouped under it — click a row to reveal the package list,
installed versions, and per-package fix availability.

To compare states (e.g. an image as released vs. after `apt full-upgrade`),
render one report per state and link them from an overview page; see
scan-images.py. This renderer deliberately has no in-page switching between
states.

Statistics (severity counts, KEV count, with-fix count) are computed over
distinct CVE IDs, not (CVE, package) pairs — the latter inflates kernel /
shared-library CVEs by the number of packages they're matched against.

Findings a reviewed exception covers (exceptedMatches, from apply-exceptions.py)
are not in the table or any count. With --exceptions-url (the dashboard, where
one exception applies across every image) the header links to that page's
"Reviewed exceptions" section; without it (a standalone report) they are
listed under the table, grouped by exception with its reason. A CVE whose
exception no longer applies (expired, new source version, unlisted package)
stays in the table, tagged for review.

Rendering is bounded: only rows matching the current filters are in the DOM
(paged, appended a few hundred rows per animation frame), and a CVE's detail
block is built when it's expanded and removed when it's collapsed, so the page
stays responsive at 10k+ CVEs — including when the browser is a Raspberry Pi.
"""
import argparse
import gzip
import html
import json
import lzma
import pathlib
import re
import sys
from collections import Counter

SEVERITY_ORDER = ["Critical", "High", "Medium", "Low", "Negligible", "Unknown"]
SEV_RANK = {s: i for i, s in enumerate(SEVERITY_ORDER)}


def load_sbom_any(path):
    data = path.read_bytes()
    if path.suffix == ".xz":
        data = lzma.decompress(data)
    elif path.suffix == ".gz":
        data = gzip.decompress(data)
    return json.loads(data)


def clean_path(p):
    """'./usr/bin/x' or '/usr/bin/x' -> 'usr/bin/x' (without eating a leading
    dot-directory such as '/.config')."""
    if p.startswith("./"):
        p = p[2:]
    return p[1:] if p.startswith("/") else p


def build_location_map(sbom):
    """(package name, version) -> sorted list of file paths it was found in.

    Uses the SPDX package<->file relationships (e.g. a go-module linked to the
    binary that embeds it) and falls back to the path in each package's
    sourceInfo. This is what lets the report show *why* a CVE is present —
    which binary a vulnerable go-module actually lives in."""
    files = {f["SPDXID"]: f.get("fileName") for f in sbom.get("files", [])}
    pkgs = {p["SPDXID"]: (p.get("name"), p.get("versionInfo")) for p in sbom.get("packages", [])}
    m: dict[tuple, set] = {}
    for r in sbom.get("relationships", []):
        a, b = r.get("spdxElementId"), r.get("relatedSpdxElement")
        pkg = a if a in pkgs else (b if b in pkgs else None)
        fil = a if a in files else (b if b in files else None)
        if pkg and fil and files.get(fil):
            m.setdefault(pkgs[pkg], set()).add(clean_path(files[fil]))
    for p in sbom.get("packages", []):
        si = p.get("sourceInfo") or ""
        mm = re.search(r":\s*(/\S+)", si)   # "...: /usr/bin/foo"
        if mm:
            m.setdefault((p.get("name"), p.get("versionInfo")), set()).add(clean_path(mm.group(1)))
    return {k: sorted(v) for k, v in m.items()}


def attach_locations(rows, loc_map):
    """Attach found-in file paths to each package entry (non-deb only: a deb's
    provenance is just the dpkg database, which isn't useful to show)."""
    if not loc_map:
        return
    for r in rows:
        for p in r["packages"]:
            if p["type"] == "deb":
                continue
            locs = loc_map.get((p["name"], p["version"]))
            if locs:
                p["locations"] = locs


def get_cvss(v):
    for cv in v.get("cvss") or []:
        m = cv.get("metrics") or {}
        s = m.get("baseScore")
        if s is not None:
            return s, cv.get("version", "")
    return None, ""


def best_desc(m):
    v = m["vulnerability"]
    d = v.get("description") or ""
    if d:
        return d
    for rv in m.get("relatedVulnerabilities") or []:
        if rv.get("description"):
            return rv["description"]
    return ""


def best_cvss(m):
    v = m["vulnerability"]
    s, ver = get_cvss(v)
    if s is not None:
        return s, ver
    for rv in m.get("relatedVulnerabilities") or []:
        s, ver = get_cvss(rv)
        if s is not None:
            return s, ver
    return None, ""


def higher_sev(a, b):
    return a if SEV_RANK.get(a, 99) <= SEV_RANK.get(b, 99) else b


def aggregate_matches(matches):
    """Group grype matches by CVE ID; merge per-package detail under each CVE."""
    by_cve = {}
    for m in matches:
        v = m["vulnerability"]
        a = m["artifact"]
        cve = v.get("id", "")
        if not cve:
            continue
        cvss_s, cvss_v = best_cvss(m)
        try:
            epss = float(v["epss"][0]["epss"])
        except (KeyError, IndexError, TypeError, ValueError):
            epss = 0.0
        try:
            epss_pct = float(v["epss"][0]["percentile"])
        except (KeyError, IndexError, TypeError, ValueError):
            epss_pct = 0.0
        fix = v.get("fix") or {}
        fix_versions = fix.get("versions") or []
        fix_state = fix.get("state", "")

        entry = by_cve.get(cve)
        if entry is None:
            entry = {
                "id": cve,
                "url": v.get("dataSource", ""),
                "sev": v.get("severity", "Unknown"),
                "cvss": cvss_s,
                "cvssV": cvss_v,
                "epss": epss,
                "epssPct": epss_pct,
                "kev": bool(v.get("knownExploited")),
                "risk": v.get("risk", 0) or 0,
                "desc": best_desc(m),
                "epochRecovered": bool(v.get("rptEpochRecovered")),
                "kernelNvd": bool(v.get("kernelNvd")),
                "kernelOsv": bool(v.get("kernelOsv")),
                "review": [],
                "packages": [],
            }
            by_cve[cve] = entry
        else:
            # Promote to highest severity / CVSS / risk seen for this CVE.
            entry["sev"] = higher_sev(entry["sev"], v.get("severity", "Unknown"))
            if cvss_s is not None and (entry["cvss"] is None or cvss_s > entry["cvss"]):
                entry["cvss"], entry["cvssV"] = cvss_s, cvss_v
            cur_risk = v.get("risk", 0) or 0
            if cur_risk > entry["risk"]:
                entry["risk"] = cur_risk
            if v.get("knownExploited"):
                entry["kev"] = True
            if v.get("rptEpochRecovered"):
                entry["epochRecovered"] = True
            if v.get("kernelNvd"):
                entry["kernelNvd"] = True
            if v.get("kernelOsv"):
                entry["kernelOsv"] = True
            if not entry["desc"]:
                entry["desc"] = best_desc(m)
        rv = m.get("exceptionReview")
        if rv:
            note = f"{a.get('name', '')} {a.get('version', '')}: exception {rv['id']} no longer applies: {rv['why']}"
            if note not in entry["review"]:
                entry["review"].append(note)

        pkg = {
            "name": a.get("name", ""),
            "version": a.get("version", ""),
            "type": a.get("type", ""),
            "fix": fix_versions,
            "fixState": fix_state,
        }
        if m.get("exception"):
            pkg["exception"] = m["exception"]["id"]
        # Dedupe identical package entries (grype occasionally emits one
        # match per namespace for the same package). If a later match for the
        # same package carries fix versions and the first didn't, keep the fix.
        sig = (pkg["name"], pkg["version"], pkg["type"])
        dup = next((p for p in entry["packages"] if (p["name"], p["version"], p["type"]) == sig), None)
        if dup is None:
            entry["packages"].append(pkg)
        elif fix_versions and not dup["fix"]:
            dup["fix"], dup["fixState"] = fix_versions, fix_state

    rows = list(by_cve.values())
    for r in rows:
        r["pkgCount"] = len(r["packages"])
        r["typesSet"] = sorted({p["type"] for p in r["packages"]})
        r["typeLabel"] = r["typesSet"][0] if len(r["typesSet"]) == 1 else "mixed"
        fixed = sum(1 for p in r["packages"] if p["fix"])
        r["fixCount"] = fixed
        r["hasFix"] = fixed > 0
        r["allFixed"] = fixed == len(r["packages"]) and fixed > 0
        # Sort packages: with-fix first, then by name.
        r["packages"].sort(key=lambda p: (0 if p["fix"] else 1, p["name"]))
        r["pkgLabel"] = r["packages"][0]["name"] if r["packages"] else ""
    return rows


def excepted_groups(matches):
    """Excepted findings grouped by the exception that covers them, for the
    report's 'Excepted' section: one group per exception, its CVEs inside."""
    groups = {}
    for m in matches:
        ex = m.get("exception") or {}
        g = groups.setdefault(ex.get("id", "?"), {**ex, "cves": []})
    for r in aggregate_matches(matches):
        by_ex = {}
        for p in r["packages"]:
            by_ex.setdefault(p.get("exception", "?"), []).append(p["name"] + " " + p["version"])
        for eid, pkgs in by_ex.items():
            groups[eid]["cves"].append({"id": r["id"], "url": r["url"], "sev": r["sev"], "risk": r["risk"],
                                        "epss": r["epss"], "kev": r["kev"], "packages": pkgs})
    out = sorted(groups.values(), key=lambda g: g.get("id", ""))
    for g in out:
        g["cves"].sort(key=lambda c: (-(c["risk"] or 0), c["id"]))
    return out


def parse_link(spec):
    if "=" not in spec:
        sys.exit(f"error: --link expects LABEL=URL, got {spec!r}")
    label, url = spec.split("=", 1)
    return {"label": label.strip(), "url": url.strip()}


def main():
    ap = argparse.ArgumentParser(description=__doc__.splitlines()[0])
    ap.add_argument("input")
    ap.add_argument("output")
    ap.add_argument("--title", default=None)
    ap.add_argument("--source-label", default=None,
                    help="Override the source label shown under the title (defaults to the input path).")
    ap.add_argument("--debian-ahead", default=None,
                    help="JSON map from debian-ahead.py; adds a 'Fix available from' column.")
    ap.add_argument("--sbom", default=None,
                    help="the syft SPDX SBOM the scan came from; enriches each package with the "
                         "file(s) it was found in (e.g. the binary a go-module is embedded in).")
    ap.add_argument("--link", action="append", default=[], metavar="LABEL=URL",
                    help="navigation link shown under the title (repeatable), e.g. 'Overview=../index.html'")
    ap.add_argument("--exceptions-url", default=None, metavar="URL",
                    help="where the reviewed exceptions are listed (e.g. '../index.html#exceptions'); the report "
                         "links there instead of listing its excepted CVEs under the table")
    args = ap.parse_args()

    src = pathlib.Path(args.input)
    data = json.loads(src.read_text())
    matches = data.get("matches", [])
    title = args.title or f"Grype report: {src.stem}"
    source_label = args.source_label or str(src)
    links = [parse_link(s) for s in args.link]

    debian_ahead = {}
    if args.debian_ahead:
        p = pathlib.Path(args.debian_ahead)
        if p.exists():
            debian_ahead = json.loads(p.read_text())
        else:
            print(f"warning: --debian-ahead {p} not found; column omitted", file=sys.stderr)
    has_debian = bool(debian_ahead)

    loc_map = {}
    if args.sbom:
        p = pathlib.Path(args.sbom)
        if p.exists():
            loc_map = build_location_map(load_sbom_any(p))
        else:
            print(f"warning: --sbom {p} not found; file locations omitted", file=sys.stderr)

    rows = aggregate_matches(matches)
    attach_locations(rows, loc_map)
    excepted = excepted_groups(data.get("exceptedMatches") or [])
    for r in rows:
        da = debian_ahead.get(r["id"])
        r["fixFrom"] = da["status"] if da else ""   # "debian" | "raspbian" | "debian-only" | ""
        r["debDetail"] = da["detail"] if da else []

    rows.sort(key=lambda r: (-(r["risk"] or 0), SEV_RANK.get(r["sev"], 99), not r["kev"], r["id"]))

    sev_counts = Counter(r["sev"] for r in rows)
    type_counts = Counter()
    for r in rows:
        for t in r["typesSet"]:
            type_counts[t] += 1
    findings_total = sum(r["pkgCount"] for r in rows)
    deb_total = sum(1 for r in rows if r.get("fixFrom") == "debian-only")

    summary = {
        "cves": len(rows),
        "findings": findings_total,
        "kev": sum(1 for r in rows if r["kev"]),
        "fix": sum(1 for r in rows if r["hasFix"]),
        "debAhead": deb_total,
        "hasDebian": has_debian,
        "sev": {s: sev_counts.get(s, 0) for s in SEVERITY_ORDER},
        "types": dict(type_counts),
        "source": source_label,
        "links": links,
        "excepted": len({c["id"] for g in excepted for c in g["cves"]}),
        "review": sum(1 for r in rows if r["review"]),
        "exceptionsUrl": args.exceptions_url or "",
    }
    if args.exceptions_url:
        excepted = []          # listed on the page the URL points at

    out = pathlib.Path(args.output)
    out.write_text(build_html(title, rows, summary, excepted))
    print(f"Wrote {out} ({len(rows)} CVEs, {findings_total} findings, "
          f"{deb_total} debian-ahead, {summary['excepted']} excepted, {summary['review']} exception(s) to review, "
          f"{out.stat().st_size / 1024 / 1024:.1f} MB)")


def js_json(obj):
    # "</" would end the <script> block early if it appeared inside a string.
    return json.dumps(obj, separators=(",", ":")).replace("</", "<\\/")


def build_html(title, rows, summary, excepted=()):
    return (TEMPLATE
            .replace("__EXCEPTED__", js_json(list(excepted)))
            .replace("__TITLE__", html.escape(title))
            .replace("__SUMMARY__", js_json(summary))
            .replace("__SEVS__", js_json(SEVERITY_ORDER))
            .replace("__TYPES__", js_json(sorted(summary["types"])))
            .replace("__DATA__", js_json(rows)))


TEMPLATE = r"""<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>__TITLE__</title>
<style>
  :root {
    --bg: #f6f7f9; --fg: #1b1f24; --muted: #5d6470;
    --card: #fff; --border: #d8dde4;
    --crit: #b00020; --high: #e35d00; --med: #c79100;
    --low: #1b6fbf; --neg: #6b6f76; --unk: #8b909a;
    --kev-bg: #ffe6e6; --kev-fg: #870000;
    --row-hover: #eef3fb;
    --fix-fg: #1b8e3f;
    --hdr: 0px;  /* measured header height, set from JS; drives the sticky offset */
  }
  * { box-sizing: border-box; }
  body { margin: 0; font: 13px/1.4 system-ui, sans-serif; color: var(--fg); background: var(--bg); }
  a { color: var(--low); }

  /* ---- sticky header: title, links, filters ---- */
  header { padding: 10px 18px 0; background: var(--card); border-bottom: 1px solid var(--border); position: sticky; top: 0; z-index: 10; }
  h1 { margin: 0 0 2px; font-size: 16px; }
  .src { color: var(--muted); font-size: 11px; font-family: ui-monospace, monospace; }
  .links { margin-top: 6px; font-size: 12px; }
  .links a { margin-right: 14px; }
  .ctl { display: flex; gap: 8px; align-items: center; margin: 8px 0 10px; flex-wrap: wrap; }
  .ctl .status { color: var(--muted); font-size: 12px; margin-left: auto; }
  input[type=search], select { padding: 5px 8px; border: 1px solid var(--border); border-radius: 4px; font-size: 13px; background: var(--card); }
  input[type=search] { width: 260px; }
  .pill { padding: 3px 9px; border-radius: 12px; border: 1px solid var(--border); background: var(--card); font-size: 12px; user-select: none; cursor: pointer; }
  .pill.active { background: var(--fg); color: var(--card); border-color: var(--fg); }
  .pill[data-sev=Critical].active   { background: var(--crit); border-color: var(--crit); }
  .pill[data-sev=High].active       { background: var(--high); border-color: var(--high); }
  .pill[data-sev=Medium].active     { background: var(--med);  border-color: var(--med); }
  .pill[data-sev=Low].active        { background: var(--low);  border-color: var(--low); }
  .pill[data-sev=Negligible].active { background: var(--neg);  border-color: var(--neg); }
  .pill[data-sev=Unknown].active    { background: var(--unk);  border-color: var(--unk); }
  .pill#kev-only.active { background: var(--kev-fg); border-color: var(--kev-fg); }
  .sevs { display: inline-flex; gap: 6px; flex-wrap: wrap; }

  /* ---- CVE table ---- */
  main { padding-bottom: 24px; }
  .empty { padding: 10px 18px; color: var(--muted); font-style: italic; background: var(--card); border-bottom: 1px solid var(--border); }
  table.cves { width: 100%; border-collapse: collapse; background: var(--card); table-layout: fixed; }
  table.cves th, table.cves td { padding: 6px 8px; border-bottom: 1px solid var(--border); text-align: left; vertical-align: top; font-size: 12px; }
  table.cves th { background: #ebeef3; cursor: pointer; user-select: none; white-space: nowrap; position: sticky; top: var(--hdr); z-index: 5; }
  table.cves th.sorted::after { content: " \25BE"; }
  table.cves th.sorted.asc::after { content: " \25B4"; }
  table.cves thead th, table.cves tr.cve > td { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
  tr.cve { cursor: pointer; }
  tr.cve:hover td { background: var(--row-hover); }
  tr.cve .caret::before { content: "\25B8"; display: inline-block; width: 12px; color: var(--muted); }
  tr.cve.open .caret::before { content: "\25BE"; }
  td.sev { font-weight: 600; }
  td.sev[data-sev=Critical]   { color: var(--crit); }
  td.sev[data-sev=High]       { color: var(--high); }
  td.sev[data-sev=Medium]     { color: var(--med); }
  td.sev[data-sev=Low]        { color: var(--low); }
  td.sev[data-sev=Negligible] { color: var(--neg); }
  td.sev[data-sev=Unknown]    { color: var(--unk); }
  td.id a { color: inherit; text-decoration: none; border-bottom: 1px dotted; }
  td.id a:hover { color: var(--low); }
  td.pkg { font-family: ui-monospace, monospace; font-size: 11px; }
  td.pkg .more { color: var(--muted); font-family: system-ui, sans-serif; }
  .tag { display: inline-block; padding: 1px 6px; margin-left: 6px; border-radius: 10px; font-size: 10px; font-weight: 700; letter-spacing: .3px; vertical-align: 1px; }
  .tag.kev  { background: var(--kev-bg); color: var(--kev-fg); }
  .tag.rpt  { background: #e6eefc; color: #1b3f7a; }
  .tag.knvd { background: #efe6fc; color: #5a1b7a; }
  .tag.kosv { background: #e6f7ec; color: #1b5e2e; }
  .tag.review { background: #fff1d6; color: #7a4a00; }
  .pill#review-only.active { background: #7a4a00; border-color: #7a4a00; }
  .review-note { margin-top: 6px; font-size: 11px; color: #7a4a00; }
  .src .review { color: #7a4a00; font-weight: 600; }
  /* ---- excepted findings ---- */
  #exc { padding: 4px 18px 0; }
  #exc > summary { cursor: pointer; font-weight: 600; padding: 8px 0; }
  #exc .exnote { color: var(--muted); font-size: 11px; max-width: 1000px; margin-bottom: 8px; }
  .exgroup { background: var(--card); border: 1px solid var(--border); border-radius: 4px; padding: 10px 14px; margin-bottom: 10px; }
  .exgroup h3 { margin: 0 0 4px; font-size: 13px; font-family: ui-monospace, monospace; }
  .exgroup .exmeta { color: var(--muted); font-size: 11px; margin-bottom: 4px; }
  .exgroup .exreason { font-size: 12px; max-width: 1000px; margin-bottom: 6px; }
  .exgroup table { border-collapse: collapse; }
  .exgroup th, .exgroup td { font-size: 11px; padding: 3px 10px 3px 0; text-align: left; border-bottom: 1px solid var(--border); }
  .exgroup td.mono { font-family: ui-monospace, monospace; }
  td.fixsum { font-size: 11px; }
  td.fixsum.all  { color: var(--fix-fg); font-weight: 600; }
  td.fixsum.some { color: var(--fix-fg); }
  td.fixsum.none { color: var(--muted); }
  td.fixfrom { font-size: 11px; }
  td.fixfrom.debian-only { color: #7a0010; font-weight: 600; }
  td.fixfrom.raspbian, td.fixfrom.debian { color: var(--fix-fg); }
  td.fixfrom.none { color: var(--muted); }
  td.num { font-variant-numeric: tabular-nums; }
  tr.more td { text-align: center; padding: 10px; background: #fafbfc; }
  tr.more button { font: inherit; font-size: 12px; padding: 5px 12px; margin: 0 4px; border: 1px solid var(--border); border-radius: 4px; background: var(--card); cursor: pointer; }
  tr.more button:hover { background: var(--row-hover); }

  tr.pkgrow { cursor: pointer; }
  tr.pkgrow:hover td { background: var(--row-hover); }
  tr.pkgrow .caret::before { content: "\25B8"; display: inline-block; width: 12px; color: var(--muted); }
  tr.pkgrow.open .caret::before { content: "\25BE"; }
  td.pkgname { font-family: ui-monospace, monospace; font-size: 11px; }
  td.pkgname .ver { color: var(--muted); }
  .cve-table { width: auto; min-width: 700px; margin-top: 6px; background: var(--card); border-collapse: collapse; table-layout: auto; }
  .cve-table th, .cve-table td { font-size: 11px; padding: 4px 8px; border-bottom: 1px solid var(--border); text-align: left; vertical-align: top; }
  .cve-table th { position: static; background: #f2f4f7; cursor: default; font-weight: 600; }
  .cve-table tr.sub { cursor: pointer; }
  .cve-table tr.sub:hover td { background: var(--row-hover); }
  .cve-table tr.subdetail td { background: #f4f6f9; white-space: normal; }
  .cve-table td.pkg-fix { font-family: ui-monospace, monospace; color: var(--fix-fg); }
  .cve-table td.pkg-fix.none { color: var(--muted); font-family: system-ui, sans-serif; }

  /* ---- expanded detail (built on demand) ---- */
  tr.detail td { background: #fafbfc; border-bottom: 2px solid var(--border); padding: 10px 14px 14px 28px; white-space: normal; }
  .desc { white-space: pre-wrap; max-width: 1000px; margin-bottom: 8px; }
  .pkg-table { width: auto; min-width: 600px; margin-top: 6px; background: var(--card); border-collapse: collapse; table-layout: auto; }
  .pkg-table th, .pkg-table td { font-size: 11px; padding: 4px 8px; border-bottom: 1px solid var(--border); text-align: left; vertical-align: top; }
  .pkg-table th { position: static; background: #f2f4f7; cursor: default; font-weight: 600; }
  .pkg-table td.mono { font-family: ui-monospace, monospace; }
  .pkg-table td.pkg-fix { font-family: ui-monospace, monospace; color: var(--fix-fg); }
  .pkg-table td.pkg-fix.none { color: var(--muted); font-family: system-ui, sans-serif; }
  .pkg-table td.pkg-loc { font-family: ui-monospace, monospace; font-size: 10px; color: var(--muted); max-width: 420px; word-break: break-all; }
  .branch-hint { font-family: system-ui, sans-serif; font-size: 10px; margin-top: 2px; color: var(--muted); }
  .deb-detail { margin-top: 6px; font-size: 11px; }
  .deb-detail.backlog { color: #7a0010; }
  .deb-detail code { font-family: ui-monospace, monospace; }
  .meta { color: var(--muted); margin-top: 8px; font-size: 11px; }
  footer { padding: 12px 18px; color: var(--muted); font-size: 11px; }
</style>
</head>
<body>
<header id="hdr">
  <h1>__TITLE__</h1>
  <div class="src" id="src"></div>
  <div class="links" id="links" hidden></div>
  <div class="ctl">
    <input type="search" id="q" placeholder="Search CVE, package, or description…">
    <span class="sevs" id="view" title="One row per CVE with its packages, or one row per package with its CVEs">
      <span class="pill active" data-view="cve">by CVE</span><span class="pill" data-view="pkg">by package</span></span>
    <span class="sevs" id="sevs"></span>
    <span class="pill" id="kev-only" title="Only CVEs on CISA's Known Exploited Vulnerabilities list">KEV only</span>
    <span class="pill" id="review-only" hidden title="Only CVEs a reviewed exception was written for but no longer covers (expired, new source version, or a package it doesn't list)">Exception needs review</span>
    <select id="fixsel" title="Filter by fix status">
      <option value="any">Any fix status</option>
      <option value="has">Has upstream fix</option>
      <option value="none">No upstream fix</option>
    </select>
    <select id="type"><option value="">All types</option></select>
    <span class="status" id="status"></span>
  </div>
</header>
<main id="main"></main>
<details id="exc" hidden></details>
<footer id="foot"></footer>
<script>
"use strict";
const DATA = __DATA__;
const SEVS = __SEVS__;
const TYPES = __TYPES__;
const SUMMARY = __SUMMARY__;
const EXCEPTED = __EXCEPTED__;
const SEV_RANK = Object.fromEntries(SEVS.map((s, i) => [s, i]));
DATA.forEach((r, i) => { r._i = i; });
const PAGE = 500;    // rows shown before "show more"
const CHUNK = 200;   // rows appended per animation frame (~0.3 s a frame on a Raspberry Pi 5)

const state = {
  sevs: new Set(SEVS),   // all severities on by default: the list is risk-sorted, and the riskiest CVEs are often Medium
  type: "",
  q: "",
  kev: false,
  review: false,
  fix: "any",            // any | has | none | debonly
  sortKey: "risk",
  sortAsc: false,
  view: "cve",           // cve: one row per CVE | pkg: one row per package, its CVEs in the detail
};

const esc = s => String(s).replace(/[&<>"']/g, c => ({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"}[c]));
const fmt = n => Number(n).toLocaleString();

// ---- columns (one definition drives colgroup, thead and the row renderer) ----
const COLS = [
  {key: "sev",      label: "Severity",           w: 118},
  {key: "id",       label: "Vulnerability",      w: 0},     // absorbs the remaining width
  {key: "pkgLabel", label: "Package",            w: 250, title: "First affected package (+N more); expand the row for all of them"},
  {key: "fixCount", label: "Fixed upstream",     w: 108, title: "Whether a fixed version exists upstream, across the packages this CVE affects"},
  {key: "fixFrom",  label: "Fix available from", w: 150, off: !SUMMARY.hasDebian,
                    title: "Whether apt on this image can install the fix: from Debian + the Pi archive (arm64), from Raspbian + the Pi archive (armhf), or not yet — Debian has it but Raspbian hasn't rebuilt it (armhf backlog)"},
  {key: "typeLabel",label: "Type",               w: 88},
  {key: "cvss",     label: "CVSS",               w: 58, num: true},
  {key: "epss",     label: "EPSS",               w: 62, num: true},
  {key: "risk",     label: "Risk",               w: 62, num: true, title: "grype's composite risk score (severity x EPSS x KEV)"},
].filter(c => !c.off);
const COLS_PKG = [
  {key: "sev",      label: "Worst severity",     w: 118},
  {key: "name",     label: "Package",            w: 0},
  {key: "n",        label: "CVEs",               w: 64, num: true},
  {key: "fixCount", label: "Fixed upstream",     w: 108, title: "How many of this package's CVEs have a fixed version upstream"},
  {key: "fixFrom",  label: "Fix available from", w: 150, off: !SUMMARY.hasDebian, title: "Whether apt on this image can install the fixes for this package"},
  {key: "type",     label: "Type",               w: 88},
  {key: "cvss",     label: "Max CVSS",           w: 72, num: true},
  {key: "epss",     label: "Max EPSS",           w: 72, num: true},
  {key: "risk",     label: "Max risk",           w: 72, num: true, title: "The highest grype risk score among this package's CVEs"},
].filter(c => !c.off);
function cols() { return state.view === "pkg" ? COLS_PKG : COLS; }
let NCOLS = COLS.length;
const FIXFROM_LABEL = {"debian": "Debian + Pi archive", "raspbian": "Raspbian + Pi archive", "debian-only": "Debian, not Raspbian", "": "—"};

// For kernel packages, say whether a fix exists on the installed version's own
// X.Y branch (an in-place patch upgrade) or only on newer branches. NVD lists
// per-branch fix points (6.1.177, 6.6.144, 6.12.95, …); this picks the relevant one.
function verTriple(v) {
  const m = String(v).replace(/^\d+:/, "").match(/(\d+)\.(\d+)\.(\d+)/);
  return m ? [+m[1], +m[2], +m[3]] : null;
}
function branchHint(name, installed, fixes) {
  if (!/^linux-(image|headers|kbuild)/.test(name || "")) return "";
  const it = verTriple(installed);
  if (!it || !fixes || !fixes.length) return "";
  const ft = fixes.map(verTriple).filter(Boolean);
  if (!ft.length) return "";
  const same = ft.filter(t => t[0] === it[0] && t[1] === it[1] && t[2] > it[2]).sort((a, b) => a[2] - b[2]);
  if (same.length) return "fixed in your " + it[0] + "." + it[1] + " branch at " + same[0].join(".");
  const newer = ft.some(t => t[0] > it[0] || (t[0] === it[0] && t[1] > it[1]));
  return newer ? "no " + it[0] + "." + it[1] + " fix — only newer branches" : "";
}

// ---- header ----
document.getElementById("src").textContent =
  SUMMARY.source + " — " + fmt(SUMMARY.cves) + " distinct CVEs (" + fmt(SUMMARY.findings) +
  " package-level findings), " + fmt(SUMMARY.kev) + " KEV, " + fmt(SUMMARY.fix) + " with an upstream fix" +
  (SUMMARY.excepted ? "; " + fmt(SUMMARY.excepted) + " more excepted after review, not counted" +
    (SUMMARY.exceptionsUrl ? " " : " (listed below the table)") : "");
if (SUMMARY.excepted && SUMMARY.exceptionsUrl) {
  const a = document.createElement("a");
  a.href = SUMMARY.exceptionsUrl;
  a.textContent = "(see Reviewed exceptions)";
  document.getElementById("src").appendChild(a);
}
if (SUMMARY.review) {
  const el = document.createElement("span");
  el.className = "review";
  el.textContent = " — " + fmt(SUMMARY.review) + " CVE" + (SUMMARY.review === 1 ? "" : "s") + " whose exception needs review";
  document.getElementById("src").appendChild(el);
  const pill = document.getElementById("review-only");
  pill.hidden = false;
  pill.textContent = "Exception needs review (" + fmt(SUMMARY.review) + ")";
  pill.onclick = function () { state.review = !state.review; this.classList.toggle("active", state.review); rerender(); };
}
if (SUMMARY.links && SUMMARY.links.length) {
  const el = document.getElementById("links");
  el.innerHTML = SUMMARY.links.map(l => '<a href="' + esc(l.url) + '">' + esc(l.label) + '</a>').join("");
  el.hidden = false;
}
if (SUMMARY.hasDebian) {
  document.getElementById("fixsel").insertAdjacentHTML("beforeend",
    '<option value="debonly">Debian has fix, Raspbian doesn’t (armhf backlog)</option>');
}
const sevBox = document.getElementById("sevs");
for (const s of SEVS) {
  const n = SUMMARY.sev[s] || 0;
  if (!n) continue;
  const el = document.createElement("span");
  el.className = "pill active";
  el.dataset.sev = s;
  el.textContent = s + " (" + fmt(n) + ")";
  el.title = "Click to hide/show " + s;
  el.onclick = () => {
    if (state.sevs.has(s)) state.sevs.delete(s); else state.sevs.add(s);
    el.classList.toggle("active", state.sevs.has(s));
    rerender();
  };
  sevBox.appendChild(el);
}
const typeSel = document.getElementById("type");
for (const t of TYPES) {
  const o = document.createElement("option");
  o.value = t; o.textContent = t + " (" + fmt(SUMMARY.types[t] || 0) + ")";
  typeSel.appendChild(o);
}
typeSel.onchange = e => { state.type = e.target.value; rerender(); };
document.getElementById("fixsel").onchange = e => { state.fix = e.target.value; rerender(); };
document.getElementById("kev-only").onclick = function () {
  state.kev = !state.kev; this.classList.toggle("active", state.kev); rerender();
};
let qTimer = null;
document.getElementById("q").oninput = e => {
  clearTimeout(qTimer);
  const v = e.target.value.trim().toLowerCase();
  qTimer = setTimeout(() => { state.q = v; rerender(); }, 120);
};

document.querySelectorAll("#view .pill").forEach(el => {
  el.onclick = () => {
    if (state.view === el.dataset.view) return;
    state.view = el.dataset.view;
    document.querySelectorAll("#view .pill").forEach(p => p.classList.toggle("active", p.dataset.view === state.view));
    state.sortKey = "risk"; state.sortAsc = false;
    rerender();
  };
});

// ---- the package view: one row per (package, version), built from the CVEs that pass the filters ----
let PKGS = [];
function buildPackages(cveRows) {
  const by = new Map();
  for (const r of cveRows) {
    for (const p of r.packages) {
      if (state.type && p.type !== state.type) continue;
      const key = p.name + "\u0000" + p.version;
      let g = by.get(key);
      if (!g) {
        g = {name: p.name, version: p.version, type: p.type, n: 0, sev: "Unknown", cvss: null, epss: 0, risk: 0, kev: false,
             fixCount: 0, fixFroms: new Set(), cves: []};
        by.set(key, g);
      }
      g.n++;
      g.sev = higherSev(g.sev, r.sev);
      if (r.cvss != null && (g.cvss == null || r.cvss > g.cvss)) g.cvss = r.cvss;
      if (r.epss > g.epss) g.epss = r.epss;
      if (r.risk > g.risk) g.risk = r.risk;
      if (r.kev) g.kev = true;
      if (p.fix && p.fix.length) { g.fixCount++; g.fixFroms.add(r.fixFrom || ""); }
      g.cves.push({r: r, fix: p.fix, fixState: p.fixState});
    }
  }
  const out = [];
  for (const g of by.values()) {
    g.fixFrom = g.fixFroms.size === 1 ? [...g.fixFroms][0] : (g.fixFroms.size > 1 ? "mixed" : "");
    g.cves.sort((a, b) => (b.r.risk - a.r.risk) || (SEV_RANK[a.r.sev] ?? 99) - (SEV_RANK[b.r.sev] ?? 99) || a.r.id.localeCompare(b.r.id));
    if (state.q) {
      const own = (g.name + " " + g.version).toLowerCase().includes(state.q);
      if (!own) g.cves = g.cves.filter(c => blob(c.r).includes(state.q));
      if (!g.cves.length) continue;
      if (!own) {   // recompute the aggregates over the CVEs that matched
        g.n = g.cves.length; g.fixCount = g.cves.filter(c => c.fix && c.fix.length).length;
        g.sev = g.cves.reduce((s, c) => higherSev(s, c.r.sev), "Unknown");
        g.cvss = g.cves.reduce((m, c) => (c.r.cvss != null && (m == null || c.r.cvss > m)) ? c.r.cvss : m, null);
        g.epss = Math.max(...g.cves.map(c => c.r.epss)); g.risk = Math.max(...g.cves.map(c => c.r.risk)); g.kev = g.cves.some(c => c.r.kev);
      }
    }
    out.push(g);
  }
  out.forEach((g, i) => { g._i = i; });
  return out;
}
function higherSev(a, b) { return (SEV_RANK[a] ?? 99) <= (SEV_RANK[b] ?? 99) ? a : b; }

// ---- filtering & sorting ----
function blob(r) {
  if (r._blob) return r._blob;
  const parts = [r.id, r.desc];
  for (const p of r.packages) parts.push(p.name, p.version);
  return (r._blob = parts.join(" ").toLowerCase());
}
function passes(r) {
  if (!state.sevs.has(r.sev)) return false;
  if (state.type && !r.typesSet.includes(state.type)) return false;
  if (state.kev && !r.kev) return false;
  if (state.review && !r.review.length) return false;
  switch (state.fix) {
    case "has":     if (!r.hasFix) return false; break;
    case "none":    if (r.hasFix) return false; break;
    case "debonly": if (r.fixFrom !== "debian-only") return false; break;
  }
  if (state.q && !blob(r).includes(state.q)) return false;
  return true;
}
function cmp(a, b) {
  const k = state.sortKey;
  let av = a[k], bv = b[k];
  if (k === "sev") { av = SEV_RANK[av] ?? 99; bv = SEV_RANK[bv] ?? 99; }
  if (av == null) av = -Infinity;
  if (bv == null) bv = -Infinity;
  let c = (typeof av === "string" || typeof bv === "string") ? String(av).localeCompare(String(bv)) : av - bv;
  if (!state.sortAsc) c = -c;
  return c || (b.risk - a.risk) || String(a.id || a.name).localeCompare(String(b.id || b.name));   // stable, meaningful tie-break
}

// ---- rendering (bounded: filtered rows only, paged, detail built on demand) ----
function fixSummary(r) {
  if (!r.pkgCount) return ["—", "none"];
  if (r.allFixed) return ["all (" + r.fixCount + ")", "all"];
  if (r.fixCount > 0) return [r.fixCount + " of " + r.pkgCount, "some"];
  return ["no fix", "none"];
}
function rowHtml(r) {
  const [fs, fc] = fixSummary(r);
  const tags = (r.kev ? '<span class="tag kev" title="On CISA\'s Known Exploited Vulnerabilities list">KEV</span>' : "") +
    (r.epochRecovered ? '<span class="tag rpt" title="Recovered by the +rpt epoch cross-check; grype hid this because the Pi epoch sorts above the Debian fix">+rpt</span>' : "") +
    (r.kernelNvd ? '<span class="tag knvd" title="From NVD per-branch kernel ranges, not Debian. NVD kernel data is noisier — verify before acting.">kernel/NVD</span>' : "") +
    (r.kernelOsv ? '<span class="tag kosv" title="From the Raspberry Pi kernel advisory feed: assessed for this exact kernel package from the kernel CVE team data and the files compiled into it">kernel/RPi</span>' : "") +
    (r.review.length ? '<span class="tag review" title="' + esc(r.review.join("\n")) + '">exception: review</span>' : "");
  const pkgTitle = r.packages.map(p => p.name + " " + p.version).join("\n");
  return '<tr class="cve" data-i="' + r._i + '">' +
    '<td class="sev" data-sev="' + esc(r.sev) + '"><span class="caret"></span>' + esc(r.sev) + '</td>' +
    '<td class="id">' + (r.url ? '<a href="' + esc(r.url) + '" target="_blank" rel="noopener">' + esc(r.id) + '</a>' : esc(r.id)) + tags + '</td>' +
    '<td class="pkg" title="' + esc(pkgTitle) + '">' + esc(r.pkgLabel) + (r.pkgCount > 1 ? ' <span class="more">+' + (r.pkgCount - 1) + '</span>' : '') + '</td>' +
    '<td class="fixsum ' + fc + '">' + fs + '</td>' +
    (SUMMARY.hasDebian ? '<td class="fixfrom ' + (r.fixFrom || "none") + '">' + FIXFROM_LABEL[r.fixFrom || ""] + '</td>' : "") +
    '<td>' + esc(r.typeLabel) + '</td>' +
    '<td class="num">' + (r.cvss != null ? r.cvss.toFixed(1) : "") + '</td>' +
    '<td class="num">' + (r.epss > 0 ? (r.epss * 100).toFixed(1) + "%" : "") + '</td>' +
    '<td class="num">' + (r.risk > 0 ? r.risk.toFixed(1) : "") + '</td>' +
    '</tr>';
}
function detailHtml(r) {
  const anyLoc = r.packages.some(p => p.locations && p.locations.length);
  const head = ["Package", "Installed", "Type", "Fix version"].concat(anyLoc ? ["Found in"] : []);
  const body = r.packages.map(p => {
    const fixCell = p.fix.length ? esc(p.fix.join(", ")) : esc(p.fixState || "—");
    const hint = branchHint(p.name, p.version, p.fix);
    return '<tr><td class="mono">' + esc(p.name) + '</td><td class="mono">' + esc(p.version) + '</td><td>' + esc(p.type) + '</td>' +
      '<td class="pkg-fix' + (p.fix.length ? "" : " none") + '">' + fixCell + (hint ? '<div class="branch-hint">' + esc(hint) + '</div>' : "") + '</td>' +
      (anyLoc ? '<td class="pkg-loc">' + ((p.locations && p.locations.length) ? p.locations.map(esc).join("<br>") : "—") + '</td>' : "") + '</tr>';
  }).join("");
  let deb = "";
  if (SUMMARY.hasDebian && r.debDetail && r.debDetail.length) {
    const lead = r.fixFrom === "debian-only" ? "Fix is in the Debian archive but not yet rebuilt into Raspbian (apt upgrade will NOT fix it): "
      : r.fixFrom === "raspbian" ? "Fix is installable via apt (Raspbian + Pi archive): "
      : r.fixFrom === "debian" ? "Fix is installable via apt (Debian + Pi archive): " : "";
    deb = '<div class="deb-detail' + (r.fixFrom === "debian-only" ? " backlog" : "") + '">' + lead +
      r.debDetail.map(d => "<code>" + esc(d) + "</code>").join(", ") + "</div>";
  }
  const meta = [];
  if (r.cvssV) meta.push("CVSS v" + esc(r.cvssV));
  if (r.epssPct) meta.push("EPSS percentile " + (r.epssPct * 100).toFixed(1) + "%");
  if (r.url) meta.push('<a href="' + esc(r.url) + '" target="_blank" rel="noopener">' + esc(r.url) + '</a>');
  const review = r.review.length ? r.review.map(t => '<div class="review-note">' + esc(t) +
    '. Re-review and update exceptions.json; until then it is reported here.</div>').join("") : "";
  return '<div class="desc">' + esc(r.desc || "(no description)") + '</div>' + review +
    '<table class="pkg-table"><thead><tr>' + head.map(h => "<th>" + h + "</th>").join("") + '</tr></thead><tbody>' + body + '</tbody></table>' +
    deb + '<div class="meta">' + meta.join(" · ") + '</div>';
}
function pkgRowHtml(g) {
  const fs = !g.n ? ["—", "none"] : g.fixCount === g.n ? ["all (" + g.n + ")", "all"] : g.fixCount ? [g.fixCount + " of " + g.n, "some"] : ["no fix", "none"];
  const ff = g.fixFrom === "mixed" ? "mixed" : (FIXFROM_LABEL[g.fixFrom || ""] || "—");
  return '<tr class="pkgrow" data-i="' + g._i + '">' +
    '<td class="sev" data-sev="' + esc(g.sev) + '"><span class="caret"></span>' + esc(g.sev) + '</td>' +
    '<td class="pkgname">' + esc(g.name) + ' <span class="ver">' + esc(g.version) + '</span>' +
      (g.kev ? '<span class="tag kev" title="At least one of this package\'s CVEs is on CISA\'s Known Exploited Vulnerabilities list">KEV</span>' : "") + '</td>' +
    '<td class="num">' + g.n + '</td>' +
    '<td class="fixsum ' + fs[1] + '">' + fs[0] + '</td>' +
    (SUMMARY.hasDebian ? '<td class="fixfrom ' + (g.fixFrom && g.fixFrom !== "mixed" ? g.fixFrom : "none") + '">' + esc(ff) + '</td>' : "") +
    '<td>' + esc(g.type) + '</td>' +
    '<td class="num">' + (g.cvss != null ? g.cvss.toFixed(1) : "") + '</td>' +
    '<td class="num">' + (g.epss > 0 ? (g.epss * 100).toFixed(1) + "%" : "") + '</td>' +
    '<td class="num">' + (g.risk > 0 ? g.risk.toFixed(1) : "") + '</td>' +
    '</tr>';
}
function pkgDetailHtml(g) {
  const head = ["Severity", "Vulnerability", "Fix version for this package", "CVSS", "EPSS", "Risk"];
  const body = g.cves.map(c => {
    const r = c.r;
    const tags = (r.kev ? '<span class="tag kev">KEV</span>' : "") + (r.epochRecovered ? '<span class="tag rpt">+rpt</span>' : "") +
      (r.kernelNvd ? '<span class="tag knvd">kernel/NVD</span>' : "") + (r.kernelOsv ? '<span class="tag kosv">kernel/RPi</span>' : "") +
      (r.review.length ? '<span class="tag review" title="' + esc(r.review.join("\n")) + '">exception: review</span>' : "");
    const fixCell = c.fix && c.fix.length ? esc(c.fix.join(", ")) : esc(c.fixState || "—");
    const hint = branchHint(g.name, g.version, c.fix);
    return '<tr class="sub" data-i="' + r._i + '" title="Click for the description">' +
      '<td class="sev" data-sev="' + esc(r.sev) + '">' + esc(r.sev) + '</td>' +
      '<td class="id">' + (r.url ? '<a href="' + esc(r.url) + '" target="_blank" rel="noopener">' + esc(r.id) + '</a>' : esc(r.id)) + tags + '</td>' +
      '<td class="pkg-fix' + (c.fix && c.fix.length ? "" : " none") + '">' + fixCell + (hint ? '<div class="branch-hint">' + esc(hint) + '</div>' : "") + '</td>' +
      '<td class="num">' + (r.cvss != null ? r.cvss.toFixed(1) : "") + '</td>' +
      '<td class="num">' + (r.epss > 0 ? (r.epss * 100).toFixed(1) + "%" : "") + '</td>' +
      '<td class="num">' + (r.risk > 0 ? r.risk.toFixed(1) : "") + '</td></tr>';
  }).join("");
  return '<div class="desc">' + esc(g.name) + ' ' + esc(g.version) + ' (' + esc(g.type) + '): ' + g.n + ' CVE' + (g.n === 1 ? "" : "s") +
    ', ' + g.fixCount + ' with an upstream fix. Click a CVE for its description.</div>' +
    '<table class="cve-table"><thead><tr>' + head.map(h => "<th>" + h + "</th>").join("") + '</tr></thead><tbody>' + body + '</tbody></table>';
}
function tableShell() {
  const C = cols();
  const cols_ = C.map(c => '<col' + (c.w ? ' style="width:' + c.w + 'px"' : "") + '>').join("");
  const ths = C.map(c => '<th data-key="' + c.key + '"' + (c.title ? ' title="' + esc(c.title) + '"' : "") +
    ' class="' + (c.num ? "num " : "") + (state.sortKey === c.key ? "sorted" + (state.sortAsc ? " asc" : "") : "") + '">' + c.label + '</th>').join("");
  return '<table class="cves"><colgroup>' + cols_ + '</colgroup><thead><tr>' + ths + '</tr></thead><tbody></tbody></table>';
}

const main = document.getElementById("main");
let ROWS = [];        // rows matching the current filters, sorted
let shown = 0;        // how many of ROWS are in the DOM
let renderGen = 0;    // bumped on every rerender so an in-flight chunked append stops
function rerender() {
  renderGen++;
  NCOLS = cols().length;
  if (state.view === "pkg") {
    const q = state.q; state.q = "";                    // the search is applied per package below, not per CVE
    const cves = DATA.filter(passes); state.q = q;
    PKGS = buildPackages(cves);
    ROWS = PKGS.slice().sort(cmp);
  } else {
    ROWS = DATA.filter(passes).sort(cmp);
  }
  shown = 0;
  main.innerHTML = ROWS.length ? tableShell() : '<div class="empty">' + (DATA.length ? "No CVEs match the current filters." : "No CVEs found.") + "</div>";
  if (ROWS.length) fillRows(Math.min(ROWS.length, PAGE), renderGen);
  updateStatus();
  measureHeader();
}
function fillRows(to, gen) {
  if (gen !== renderGen) return;                     // filters changed underneath us
  const tbody = main.querySelector("tbody");
  const moreRow = tbody.querySelector("tr.more");
  if (moreRow) moreRow.remove();
  const end = Math.min(to, shown + CHUNK);
  let h = "";
  for (let i = shown; i < end; i++) h += (state.view === "pkg" ? pkgRowHtml(ROWS[i]) : rowHtml(ROWS[i]));
  const left = ROWS.length - end;
  if (left > 0) {
    h += '<tr class="more"><td colspan="' + NCOLS + '">' + fmt(end) + " of " + fmt(ROWS.length) + " shown · " +
      (end < to ? "rendering…"
        : '<button data-n="' + PAGE + '">Show ' + fmt(Math.min(PAGE, left)) + ' more</button>' +
          (left > PAGE ? '<button data-n="all">Show all ' + fmt(ROWS.length) + '</button>' : "")) + '</td></tr>';
  }
  tbody.insertAdjacentHTML("beforeend", h);
  shown = end;
  updateStatus();
  if (end < to) requestAnimationFrame(() => fillRows(to, gen));   // next chunk, next frame
}
function updateStatus() {
  let s;
  if (state.view === "pkg") {
    const n = ROWS.reduce((t, g) => t + g.n, 0);
    s = "Showing " + fmt(shown) + (shown !== ROWS.length ? " of " + fmt(ROWS.length) : "") + " packages (" + fmt(n) + " CVE findings)";
  } else {
    s = "Showing " + fmt(shown) + (shown !== ROWS.length ? " of " + fmt(ROWS.length) : "") + " CVEs";
    if (ROWS.length !== DATA.length) s += " (" + fmt(DATA.length) + " before filters)";
  }
  document.getElementById("status").textContent = s;
}
function measureHeader() {
  document.documentElement.style.setProperty("--hdr", document.getElementById("hdr").offsetHeight + "px");
}
window.addEventListener("resize", measureHeader);

// ---- interaction: one delegated listener for expand/collapse, paging, sorting ----
main.addEventListener("click", ev => {
  if (ev.target.closest("a")) return;
  const btn = ev.target.closest("tr.more button");
  if (btn) {
    fillRows(btn.dataset.n === "all" ? ROWS.length : Math.min(ROWS.length, shown + PAGE), renderGen);
    return;
  }
  const th = ev.target.closest("th[data-key]");
  if (th) {
    const k = th.dataset.key;
    if (state.sortKey === k) state.sortAsc = !state.sortAsc;
    else { state.sortKey = k; state.sortAsc = (k === "id" || k === "pkgLabel" || k === "typeLabel" || k === "sev" || k === "name" || k === "type"); }
    rerender();
    return;
  }
  const sub = ev.target.closest("tr.sub");
  if (sub) {                                                 // a CVE inside a package's detail: toggle its description
    const nx = sub.nextElementSibling;
    if (nx && nx.classList.contains("subdetail")) { nx.remove(); return; }
    const r = DATA[+sub.dataset.i];
    const meta = [];
    if (r.cvssV) meta.push("CVSS v" + esc(r.cvssV));
    if (r.epssPct) meta.push("EPSS percentile " + (r.epssPct * 100).toFixed(1) + "%");
    if (r.url) meta.push('<a href="' + esc(r.url) + '" target="_blank" rel="noopener">' + esc(r.url) + '</a>');
    const d = document.createElement("tr"); d.className = "subdetail";
    d.innerHTML = '<td colspan="6"><div class="desc">' + esc(r.desc || "(no description)") + '</div><div class="meta">' + meta.join(" · ") + '</div></td>';
    sub.after(d);
    return;
  }
  const pr = ev.target.closest("tr.pkgrow");
  if (pr) {
    const next = pr.nextElementSibling;
    if (next && next.classList.contains("detail")) { next.remove(); pr.classList.remove("open"); return; }
    const dr = document.createElement("tr");
    dr.className = "detail";
    dr.innerHTML = '<td colspan="' + NCOLS + '">' + pkgDetailHtml(PKGS[+pr.dataset.i]) + '</td>';
    pr.after(dr);
    pr.classList.add("open");
    return;
  }
  const tr = ev.target.closest("tr.cve");
  if (!tr) return;
  const next = tr.nextElementSibling;
  if (next && next.classList.contains("detail")) {          // collapse: drop the detail row entirely
    next.remove();
    tr.classList.remove("open");
    return;
  }
  const dr = document.createElement("tr");
  dr.className = "detail";
  dr.innerHTML = '<td colspan="' + NCOLS + '">' + detailHtml(DATA[+tr.dataset.i]) + '</td>';
  tr.after(dr);
  tr.classList.add("open");
});

document.getElementById("foot").textContent =
  "By CVE: one row per distinct CVE; the Package column shows the first affected package (+N more); click a row for the description, " +
  "every affected package with its installed version, and the fix version if one exists. By package: one row per installed package " +
  "with its worst severity and highest scores; click a row for its CVEs, and a CVE for its description. " +
  "Click a severity chip to hide or show that severity; click a column header to sort.";

// ---- excepted findings: static, small; grouped by the exception that covers them ----
if (EXCEPTED.length) {
  const JUST = {
    component_not_present: "component not present",
    vulnerable_code_not_present: "vulnerable code not present",
    vulnerable_code_not_in_execute_path: "vulnerable code not in execute path",
    vulnerable_code_cannot_be_controlled_by_adversary: "vulnerable code cannot be controlled by an adversary",
    inline_mitigations_already_exist: "inline mitigations already exist",
  };
  const exc = document.getElementById("exc");
  exc.innerHTML = '<summary>' + fmt(SUMMARY.excepted) + ' CVE' + (SUMMARY.excepted === 1 ? "" : "s") +
    ' excepted after review (not counted above)</summary>' +
    '<div class="exnote">Each exception below was reviewed for the listed packages as built from specific Debian source versions, and expires. ' +
    'A new source version, an unlisted package from the same source, or expiry puts the CVE back in the table above, tagged ' +
    '<span class="tag review">exception: review</span>. The exceptions live in <code>exceptions.json</code> in the cve-list repository.</div>' +
    EXCEPTED.map(g => '<div class="exgroup"><h3>' + esc(g.id) + '</h3>' +
      '<div class="exmeta">Not affected: ' + esc(JUST[g.justification] || g.justification || "") + ' · reviewed by ' + esc(g.reviewedBy || "?") +
        ' on ' + esc(g.reviewed || "?") + ' · expires ' + esc(g.expires || "?") + '</div>' +
      '<div class="exreason">' + esc(g.reason || "") + '</div>' +
      '<table><thead><tr><th>Vulnerability</th><th>Severity</th><th>Package</th><th>EPSS</th><th>Risk</th></tr></thead><tbody>' +
      g.cves.map(c => '<tr><td>' + (c.url ? '<a href="' + esc(c.url) + '" target="_blank" rel="noopener">' + esc(c.id) + '</a>' : esc(c.id)) +
        (c.kev ? '<span class="tag kev">KEV</span>' : "") + '</td><td>' + esc(c.sev) + '</td><td class="mono">' + c.packages.map(esc).join("<br>") +
        '</td><td>' + (c.epss > 0 ? (c.epss * 100).toFixed(1) + "%" : "") + '</td><td>' + (c.risk > 0 ? c.risk.toFixed(1) : "") + '</td></tr>').join("") +
      '</tbody></table></div>').join("");
  exc.hidden = false;
}

rerender();
</script>
</body>
</html>
"""

if __name__ == "__main__":
    main()