Package-level declarations

A CaseInsensitiveIgnoreDashMatch indicates a (string-based) match that is case-insensitive and ignores dashes. This is a relatively high match value, but not as high as a CaseInsensitiveMatch.

A CaseInsensitiveMatch indicates a (string-based) match that is case-insensitive. This is a high match value, but not as high as a DefiniteMatch.

A CombinedMatch indicates a match that is combined from multiple elements with different confidence.

A DefinitelyNoMatch indicates a definite no match. This is the lowest possible match value.

A DefiniteMatch indicates a definite match. This is the highest possible match value. This should be used if two properties match exactly -- either lexically or by rules defined in a specification. For example if one Cpe matches another, this is a DefiniteMatch.

A DifferentSources indicates that the information comes from different sources (e.g., matching a Cpe.getVendor to a vendor specified in a Csaf.Branche. This can be used to "multiply" the matching confidence with this value to adjust it for the different sources.

A wrapper class for usage of immutable objects as Keys in HashMaps/HashSets. The wrapper calls hashCode() of the wrapped object only once and caches its result. This is valid for immutable objects and speeds up HashMaps/HashSets operations considerably.

A data class representing a match between an Csaf.Product to an SBOMComponent with given MatchingConfidence.

Matcher for matching an SBOM database with provided CSAF documents.

DefiniteMatch and DefinitelyNoMatch

A MatchPackageNoVersion indicates a match, but the version is not set. This is a partial match because we consider that semantically means that the package is affected, but we do not know which version. So in theory, all versions that are in the SBOM could be a match. It is not a definite match, but it is also not a no match. It is a partial match.

A MatchWithoutVendor indicates that the match is without a vendor. This is a partial match because vendors are often omitted in SBOMs, but they are important for exact matching. So we consider this a partial match.

A PartialStringMatch indicates that a string property of the vulnerable product partially matches the affected component's string property.

A utility class for a Product and a list of Csaf.Branches that define the "path" from the root of the Csaf.ProductTree to the Product

A single Bill-of-Materials (SBOM).

A single component in an SBOM.

A database of SBOMs represented as a list of SBOM instances.

A Cpe object that is derived from a Node.identifiers.

Gathers all Products in the current document and their branches. The predicate is used to filter the products. If it is null, all products are returned.

This is the core function of the Matcher. It matches a vulnerable product against a component by comparing different Property objects in a defined order.

Matches a certain property (of type PropertyType) from a vulnerable product against a property from a component. The property is provided by a ProviderType.