Consult package vulnerabilities outside upload/download phase

[carlosthe19916]

Context

Currently the 3 ways in which the vulnerabilities of a package can be consulted/verified are:

• Upload phase
• Download phase
• Scan/Task analysis

The Vulnerabilies Database in Trustify is always changing so a Non Vulnerable package can have Vulnerabilities tomorrow

Problem statement

A REST API client (e.g. UI app or similar) would like to know the vulnerabilities by which certain package is affected without downloading the package.

Current approach:

• Three steps:
  • Scan/Task package
  • Wait for the task to complete
  • Verify the vulnerabilities for the package

Limitations of the current approach:

• Trigger a Scan/Task requires a Write permissions while those who want to the package vulnerabilities might only need Read permissions
• The Three steps system described above, while easy to be executed manually, it brings its challenges when automated on the client side (e.g.)
  • The UI would need to continuously fetch data to know whether or not the Scan/Task has finished while at the same time anyone else could be triggering a new scan in parallel