[jira] [Created] (CAMEL-23869) camel-jbang TUI - Add vulnerability scanning panel using OSV.dev

["Claus Ibsen (Jira)" <ji...@apache.org>]

Claus Ibsen created CAMEL-23869:
-----------------------------------

             Summary: camel-jbang TUI - Add vulnerability scanning panel using OSV.dev
                 Key: CAMEL-23869
                 URL: https://issues.apache.org/jira/browse/CAMEL-23869
             Project: Camel
          Issue Type: Improvement
          Components: camel-jbang
            Reporter: Claus Ibsen


Add a vulnerability scanning panel to the Camel TUI that queries the OSV.dev API to check dependencies of running Camel integrations for known CVEs.

The Maveniverse Pilot project (https://github.com/maveniverse/pilot) already has a clean implementation of this using the same TamboUI widget framework that the Camel TUI uses. The key pieces that could be adopted:

h3. OSV.dev Client
A lightweight HTTP client (~130 lines) that queries https://api.osv.dev/v1/query with Maven ecosystem coordinates (groupId:artifactId + version). Returns vulnerability id, summary, severity, published date, and aliases (GHSA/CVE cross-references). No API key required.

h3. Interactive TUI Panel
- Severity-coded rows: CRITICAL (red bold), HIGH (yellow), MEDIUM (white), LOW (dim)
- Group vulnerabilities by CVE ID, deduplicating aliases (e.g. GHSA-xxx and CVE-xxx pointing to the same issue)
- Expandable tree showing affected artifacts under each CVE group
- Scope filtering (compile, runtime, test, provided)
- Search and sort support
- Detail pane with links to NVD/GHSA/OSV pages

h3. Non-Interactive CI Mode
Support a non-interactive mode (e.g. via camel audit or similar) with:
- report action: plain-text vulnerability report to stdout
- check action: fail with exit code 1 if vulnerabilities at or above a severity threshold are found (default: HIGH, configurable)

h3. Optional: License Scanning
Pilot also combines license scanning (fetching POM metadata from Maven Central) with vulnerability scanning in the same audit view. This could be a follow-up enhancement.

h3. Reference Implementation
See the Pilot source code:
- [OsvClient.java|https://github.com/maveniverse/pilot/blob/main/pilot-core/src/main/java/eu/maveniverse/maven/pilot/OsvClient.java] - OSV API client
- [AuditTui.java|https://github.com/maveniverse/pilot/blob/main/pilot-core/src/main/java/eu/maveniverse/maven/pilot/AuditTui.java] - Interactive TUI panel
- [AuditReporter.java|https://github.com/maveniverse/pilot/blob/main/pilot-core/src/main/java/eu/maveniverse/maven/pilot/AuditReporter.java] - Non-interactive reporter
- [AuditMojo.java|https://github.com/maveniverse/pilot/blob/main/pilot-plugin/src/main/java/eu/maveniverse/maven/pilot/mvn3/AuditMojo.java] - Maven plugin entry point

The Camel TUI already has classpath/dependency information available from the running application, so the data source is there. The TamboUI rendering patterns from Pilot would translate directly.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)