Jens Reimann ctron

Correlation Engine Scenario Test Results

Scenario	Result	Notes
S1	FAILED	TC-2621: cross-stream matching
S2	FAILED	TC-2622: wrong version scheme (golang OCI)
S3	FAILED	TC-2623: wrong product matching (hummingbird/curl)
S4	PASS
S5 CDX	DATA	Upstream CSAF lacks VERS ranges — see S5a
S5 SPDX	DATA	Upstream CSAF lacks VERS ranges — see S5a

Correlation Engine Redesign — Roadmap

What Correlation Is

Correlation is the core value proposition of Trustify: matching advisory data (CSAF, OSV, CVE, NVD) against SBOMs to answer "what vulnerabilities affect my software?"

The system must take a component identifier — a PURL, CPE, or file hash — and determine which advisories assert something about it, what status each advisory

Correlation Test Suite (TC-5639) — Scenario Evaluation

Evaluation of 18 test scenarios (S1–S18) against their referenced Jira tickets and the governing specifications (CSAF v2.0, OSV Schema, VEX consumer requirements, RPM versioning).

S1–S14 from commit 8e614fea (PR #2613). S15–S18 from open PRs #2621, #2625, #2626,

Evaluation: CISA KEV Catalog Integration (PR #2553)

Jira: TC-5744 | PR: guacsec/trustify#2553 | Date: 2026-08-26

Summary

PR #2553 adds integration with CISA's Known Exploited Vulnerabilities (KEV) catalog to Trustify. The KEV catalog is a curated list of ~1,300 CVEs that are actively exploited in the wild, maintained under Binding Operational Directive 22-01. It complements existing data in Trustify:

CSAF/VEX (already in Trustify): "Is this product affected by this CVE?"
CVSS (already in Trustify): "How severe is this CVE?"

Pre-reqs

Have minikube running

Prepare Minikube

Log in to the Minikube VM and become root:

minikube ssh

sudo su - root

Keybase proof

I hereby claim:

I am ctron on github.
I am ctron (https://keybase.io/ctron) on keybase.
I have a public key ASA_VJJxqDRP65x9OEBCDxldFJimEuRZd1rKFII6BpaR-go

To claim this, I am signing this object:

	kind: Job
	apiVersion: batch/v1
	metadata:
	name: outflux
	spec:
	parallelism: 1
	completions: 1
	template:
	metadata:
	labels:

	// Copyright 2021 Red Hat Inc.
	//
	// Licensed under the Apache License, Version 2.0 (the "License");
	// you may not use this file except in compliance with the License.
	// You may obtain a copy of the License at
	//
	// http://www.apache.org/licenses/LICENSE-2.0
	//
	// Unless required by applicable law or agreed to in writing, software
	// distributed under the License is distributed on an "AS IS" BASIS,

	---
	apiVersion: v1
	kind: ServiceAccount
	metadata:
	name: cleaner
	---
	kind: Role
	apiVersion: rbac.authorization.k8s.io/v1
	metadata:
	name: cleaner