## Proposal Vulnerabilities are added to or remove from projects whenever vulnerability advisories are ingested into the backend. A project might depend on multiple version of a package, so a newly ingested advisory might match multiple SBOM components of the same project. <details><summary>Diagram</summary>  </details> ## Implementation As of today, Aug 10, 2023. 1. During the sync, `PackageMetadata::Ingestion::Advisory::IngestionService` publishes `PackageMetadata::IngestedAdvisoryEvent` events for each advisory being ingested. https://gitlab.com/gitlab-org/gitlab/-/merge_requests/127805 1. The `PackageMetadata::AdvisoryScanWorker` subscribes to that event. It responds by calling the `AdvisoryScanService`. https://gitlab.com/gitlab-org/gitlab/-/merge_requests/127800 1. `AdvisoryScanService` creates vulnerabilities in all affected projects. 1. It iterates all the `AffectedPackage` models of the `Advisory` model, and for each, 1. Merge the two models into an advisory PORO. https://gitlab.com/gitlab-org/gitlab/-/merge_requests/128811 1. Fetch all the affected components (PORO) across all projects using the `AffectedComponentFetcher`. https://gitlab.com/gitlab-org/gitlab/-/merge_requests/128941 1. In a DB transaction, and for each affected SBOM component, 1. It calls the `VulnerabilityScanning::CreateVulnerabilityService` with the advisory PORO and the affected component PORO. https://gitlab.com/gitlab-org/gitlab/-/merge_requests/128170 ## Implementation Plan **Scan on advisory ingestion** - add worker to encapsulate the scan of a single advisory, and trigger it from the ingestion service - https://gitlab.com/gitlab-org/gitlab/-/issues/371063+ - add service to fetch the components that match an advisory - https://gitlab.com/gitlab-org/gitlab/-/issues/420042+ - add service for doing the scanning - https://gitlab.com/gitlab-org/gitlab/-/issues/371065+ 1. find SBOM components (in projects) that match the PURL type and package name of the advisory using service from https://gitlab.com/gitlab-org/gitlab/-/issues/420042 1. for each SBOM component, upsert a vulnerability - if version is affected but vulnerability does not exist, create one - if version is affected and vulnerability exists, update it - if version is not affected but vulnerability exists, dismiss it