Vulnerability Refactor

[jsandas]

This pull request removes the in-tree implementations and dependencies for TLS vulnerability checks (CCS Injection, Heartbleed, and Debian Weak Key) and replaces them with the new external github.com/jsandas/tls-vuln-checker package. It also removes the nmap dependency and related resources from the Docker build, simplifying the codebase and build process.

Migration to external vulnerability checker:

• Replaced in-tree vulnerability code (pkg/vuln/ccs, pkg/vuln/heartbleed, pkg/vuln/weakkey) with imports from github.com/jsandas/tls-vuln-checker, removing local implementations and associated tests. [1] [2] [3] [4] [5] [6] [7] [8]
• Updated go.mod to remove the github.com/Ullaakut/nmap/v2 and other now-unused dependencies, and add github.com/jsandas/tls-vuln-checker and github.com/jsandas/starttls-go.

Docker build and resources cleanup:

• Removed installation of nmap and copying of resources/nmap from the Dockerfile, as these are no longer required. [1] [2]

Test adjustments:

• Updated scanner tests to reflect changes in supported configurations, reducing the expected config length from 4 to 2.

Documentation cleanup:

• Removed local README files for the deleted vulnerability checkers. [1] [2]

These changes centralize vulnerability checks in a dedicated external package, streamline dependencies, and simplify the codebase.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 64.47%. Comparing base (17ea756) to head (a6437dc).
⚠️ Report is 6 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master      #61      +/-   ##
==========================================
+ Coverage   62.81%   64.47%   +1.65%     
==========================================
  Files          19       15       -4     
  Lines         944      774     -170     
==========================================
- Hits          593      499      -94     
+ Misses        303      235      -68     
+ Partials       48       40       -8     

Flag	Coverage Δ
unittests	64.47% <ø> (+1.65%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This pull request migrates TLS vulnerability detection (CCS Injection, Heartbleed, Debian Weak Key) from in-repo implementations to the external github.com/jsandas/tls-vuln-checker module, and simplifies the Docker build by removing the nmap dependency and related resources.

Changes:

• Replaced in-tree vulnerability checker packages with tls-vuln-checker imports and updated the scanner’s vulnerability types accordingly.
• Removed nmap from the Docker image build and deleted related nmap script resources.
• Updated module dependencies and adjusted scanner test expectations.

Reviewed changes

Copilot reviewed 14 out of 15 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
pkg/scanner/scanner.go	Switches vulnerability checker types/imports to the external tls-vuln-checker package.
pkg/scanner/scanner_test.go	Updates expectations for supported configuration results.
go.mod	Removes nmap dependency; adds tls-vuln-checker and starttls-go.
go.sum	Updates checksums to reflect dependency removals/additions.
Dockerfile	Removes nmap install and stops copying nmap resources into the runtime image.
resources/nmap/ssl-ccs-injection.nse	Deletes the in-repo nmap script used for CCS injection detection.
pkg/vuln/**	Removes local vulnerability implementations and their tests/docs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.