Quest to determine the 'G' in GUAC

 	
mutation IngestPackage($pkg: PkgInputSpec!) {
	ingestPackage(pkg: $pkg) {
  	...AllPkgTree
  }
}
  

 	
mutation IsDependency(
	$pkg: PkgInputSpec!
  $depPkg: PkgInputSpec!
  $dependency: IsDependencyInputSpec!
) {
	ingestDependency(pkg: $pkg, depPkg: $depPkg, dependency: $dependency) {
  	...allIsDependencyTree
  }
}
  

 	
./bin/guacone query vuln "pkg:guac/spdx/ghcr.io/guacsec/vul-image-latest"
+-------------+-----------+---------------------------------------+
| NODE TYPE   | NODE ID # | ADDITIONAL INFORMATION                |
+-------------+-----------+---------------------------------------+
| certifyVuln | 131588    | vulnerability ID: ghsa-vwqq-5vrc-xw9h |
| certifyVuln | 131585    | vulnerability ID: ghsa-8489-44mv-ggj8 |
| certifyVuln | 131594    | vulnerability ID: ghsa-jfh8-c2jp-5v3q |
| certifyVuln | 131598    | vulnerability ID: ghsa-7rjr-3q55-vv33 |
| certifyVuln | 131600    | vulnerability ID: ghsa-p6xc-xr62-6r2g |
| certifyVuln | 131590    | vulnerability ID: ghsa-fxph-q3j8-mv87 |
| certifyVuln | 131574    | vulnerability ID: ghsa-599f-7c49-w659 |
+-------------+-----------+---------------------------------------+
  

 	
"DependencyType determines the type of the dependency."
enum DependencyType {
	"direct dependency"
  DIRECT
  "indirect dependency"
  INDIRECT
  "type not known/not specified"
  UNKNOWN
}

"IsDependency is an attestation to record that a package depends on another."
type IsDependency {
	id: ID!
  "Package that has the dependency"
  package: Package!
  "Package for the dependency; MUST BE PackageName, not PackageVersion"
  dependentPackage: Package!
  "Version range for the dependency link"
  versionRange: String!
  "Type of dependency"
  dependencyType: DependencyType!
  "Justification for the attested relationship"
  justification: String!
  "Document from which this attestation is generated from"
  origin: String!
  "GUAC collector for the document"
  collector: String!
}
  

 	
LET firstPkg = FIRST(
			FOR pkg IN Pkg
    				FILTER pkg.root == 'pkg'
            	FOR pkgHasType IN OUTBOUND pkg PkgHasType
              	FILTER pkgHasType.type == doc.pkgType && pkgHasType._parent == pkg._id
                	FOR pkgHasNamespace IN OUTBOUND pkgHasType PkgHasNamespace
                  		FILTER pkgHasNamespace.namespace == doc.namespace && pkgHasNamespace._parent == pkgHasType._id
                      	FOR pkgHasName IN OUTBOUND pkgHasNamespace PkgHasName			        
                        			FILTER pkgHasName.name == doc.name && pkgHasName._parent == pkgHasNamespace._id
                            FOR pkgHasVersion IN OUTBOUND pkgHasName PkgHasVersion
                            			FILTER pkgHasVersion.version == doc.version && pkgHasVersion.subpath == doc.subpath &&
pkgHasVersion.qualifier_list == doc.qualifier && pkgHasVersion._parent == pkgHasName._id	
			RETURN {
      	'type': pkgHasType.type,
      	'namespace': pkgHasNamespace.namespace,
        'name': pkgHasName.name,
        'version': pkgHasVersion.version,
        'subpath': pkgHasVersion.subpath,
        'qualifier_list': pkgHasVersion.qualifier_list,
        'versionDoc': pkgHasVersion
      }
  )
  
LET secondPkg = FIRST(
	FOR pkg IN Pkg
  	FILTER pkg.root == 'pkg'
    			FOR pkgHasType IN OUTBOUND pkg PkgHasType
          			FILTER pkgHasType.type == doc.secondPkgType && pkgHasType._parent == pkg._id
              FOR pkgHasNamespace IN OUTBOUND pkgHasType PkgHasNamespace
              			FILTER pkgHasNamespace.namespace == doc.secondNamespace && pkgHasNamespace._parent == pkgHasType._id
                    	FOR pkgHasName IN OUTBOUND pkgHasNamespace PkgHasName				        
                      	FILTER pkgHasName.name == doc.secondName && pkgHasName._parent == pkgHasNamespace._id
RETURN {
	'type': pkgHasType.type,
  'namespace': pkgHasNamespace.namespace,
  'name': pkgHasName.name,
  'nameDoc': pkgHasName
}
)

	LET isDependency = FIRST(
				UPSERT { packageID:firstPkg.versionDoc._id, depPackageID:secondPkg.nameDoc._id, versionRange:doc.versionRange,
dependencyType:doc.dependencyType, justification:doc.justification, collector:doc.collector, origin:doc.origin }
				INSERT { packageID:firstPkg.versionDoc._id, depPackageID:secondPkg.nameDoc._id, versionRange:doc.versionRange,
dependencyType:doc.dependencyType, justification:doc.justification, collector:doc.collector, origin:doc.origin }
				UPDATE {} IN isDependencies	
        RETURN NEW
        )
        
  LET edgeCollection = (FOR edgeData IN [
  				{fromKey: isDependency._key, toKey: secondPkg.nameDoc._key, from: isDependency._id, to: secondPkg.nameDoc._id,
label: 'dependency'},
					{fromKey: firstPkg.versionDoc._key, toKey: isDependency._key, from: firstPkg.versionDoc._id, to: isDependency._id, 
label: 'subject'}]

					INSERT { _key: CONCAT('isDependencyEdges', edgeData.fromKey, edgeData.toKey), _from: edgeData.from, _to:
edgeData.to, label : edgeData.label } INTO isDependencyEdges OPTIONS { overwriteMode: 'ignore' }
					)
          
    RETURN {
    			'firstPkgType': firstPkg.type,
          'firstPkgNamespace': firstPkg.namespace,
          'firstPkgName': firstPkg.name,
          'firstPkgVersion': firstPkg.version,
          'firstPkgSubpath': firstPkg.subpath,
          'firstPkgQualifier_list': firstPkg.qualifier_list,
          'secondPkgType': secondPkg.type,
          'secondPkgNamespace': secondPkg.namespace,
          'secondPkgName': secondPkg.name,
          'versionRange': isDependency.versionRange,
          'dependencyType': isDependency.dependencyType,
          'justification': isDependency.justification,
          'collector': isDependency.collector,
          'origin': isDependency.origin
    }
  

 	
MATCH (root:Pkg)-[:PkgHasType]->(type:PkgType)-[:PkgHasNamespace]->(namespace:PkgNamespace)-[:PkgHasName]->(name:PkgName)-[:PkgHasVersion]->(version:PkgVersion), (objPkgRoot:Pkg)-[:PkgHasType]->(objPkgType:PkgType)-[:PkgHasNamespace]->(objPkgNamespace:PkgNamespace)-[:PkgHasName]->(objPkgName:PkgName) 

WHERE type.type = $pkgType AND namespace.namespace = $pkgNamespace AND name.name = $pkgName AND version.version = $pkgVersion AND version.subpath = $pkgSubpath AND version.qualifier_list = $pkgQualifierList AND objPkgType.type = $objPkgType AND objPkgNamespace.namespace = $objPkgNamespace AND objPkgName.name = $objPkgName

MERGE (version)<-[:subject]-
(isDependency:IsDependency{versionRange:$versionRange,dependencyType:$dependencyType,justification:$justification,origin:$origin,collector:$collector})-[:dependency]->(objPkgName) 

RETURN type.type, namespace.namespace, name.name, version.version, version.subpath, version.qualifier_list, isDependency, objPkgType.type, objPkgNamespace.namespace, objPkgName.name