vulnerability-prioritization-engine

The module requires Go 1.26.2 or newer. This patched toolchain is required for the standard-library archive parsing vulnerability used by local source acquisition.

FLPATH-5012 analysis context

The analysiscontext package prepares a versioned, fingerprinted RepositoryAnalysisProfile for the sibling Java adapter:

TargetApplicationSet + RepositoryAnalysisProfile
    -> dry-run / controlled acquisition / sandboxed preparation
    -> fingerprinted AnalysisContext

The profile keeps production authoritative and test/development variants separate. It records the immutable source commit, source/dependency/build/ generated-source/toolchain/analyzer fingerprints, provenance, freshness inputs, and explicit preparation failures. It never fills missing profile values from an analyzer default.

make context-dry-run expects a clean checkout of https://github.com/lzspangler/spring-boot-example-application at commit 01a18a1b40e151ffcc1d7bef86bf335f87999750, cloned next to this repository as ../spring-boot-example-application.

Validate the checked-in FSI profile with:

make profile-validate
make context-dry-run
make test
make vet

For a local cross-repository validation run, use the Java adapter's manual runner. It archives the pinned application commit, runs the Maven production build, emits a direct AnalysisContext, runs the Java adapter, and validates the resulting provenance and capability evidence:

cd ../java-analysis-adapter
spike/scripts/run-manual-integration.sh

The generated run directory is disposable and ignored by Git. Tekton is not required for this validation path.

The preparation package supplies interfaces for controlled acquisition and an outer sandbox. The portable os/exec runner refuses to claim network isolation or resource limits it cannot enforce itself. The Java adapter remains in project-lightpath/java-analysis-adapter.