Module resolve 

Where a scan’s advisories come from, and the evidence that says so.

• Offline (intel.offline = true, the default on the secure side): the local database, always. The network gate is IntelNet::offline, which has no fetcher behind it, so a fetch is refused, not attempted.
• Online: the feeds, fetched and normalized now. When any feed cannot be fetched (no network), the local database, and the evidence says why.

Either way the evidence names the bundle sequence and snapshot date, so a stale database is visible in every verdict, and the StalenessRule turns age into a warning and then into a block.

Structs

IntelEvidence

What a verdict was computed against.

IntelScanner

modgunn’s scanner over a resolved database, with the staleness rule folded into every verdict.

IntelSettings

The intel block of a Holger config, as the scanners need it.

IntelVerdict

A verdict and what it was computed against.

LiveIntel

The server’s live view of the local database: re-reads the small install record per call and reloads the set only when the sequence moved, so an import goes live without a restart.

ResolvedAdvisories

A database and its evidence.

Constants

FINDING_EXPIRED

A scan against a database older than block_after_days.

FINDING_MISSING

A scan with no advisory database at all.

FINDING_STALE

A scan against a database older than warn_after_days.

Functions

fold_staleness

Add the staleness finding to v and raise its decision: a warning to at least Warn, an expired or missing database to Block.

resolve

The advisories for a scan: offline → local; online → the feeds, or local when the network is not there.

resolve_local

The local database, judged by rule at now. No database is not an error: it is a none evidence that blocks every scan.

scan_against

Scan artifact under policy against a shared database, staleness folded in. The database is borrowed, never cloned, so a server holding one LiveIntel set scans every request against the same allocation.