Repository: anchore/vunnel (language: python)

Issue:
Every provider should have "data to vuln object" unit test
**What would you like to be added**:

Every provider has unit tests that assert that it can process a representative sample of records - completeness of our ability to process provider data is asserted at the unit test level.

**Why is this needed**:

We recently had some bugs merged into vunnel that should have failed unit tests - this issue exists to track getting the test coverage high enough.

**Additional context**:
The recent failure was in the debian provider, but we should check all the providers.

Providers:
- [x] alpine https://github.com/anchore/vunnel/pull/336
- [x] amazon https://github.com/anchore/vunnel/pull/337
- [x] ~~centos~~
- [x] chainguard https://github.com/anchore/vunnel/pull/339
- [x] debian https://github.com/anchore/vunnel/pull/318
- [x] github https://github.com/anchore/vunnel/pull/346
- [x] mariner https://github.com/anchore/vunnel/pull/347
- [x] nvd https://github.com/anchore/vunnel/pull/340
- [x] oracle https://github.com/anchore/vunnel/pull/341
- [x] rhel https://github.com/anchore/vunnel/pull/342
- [x] sles https://github.com/anchore/vunnel/pull/343
- [x] ubuntu https://github.com/anchore/vunnel/pull/344
- [x] wolfi https://github.com/anchore/vunnel/pull/345




Discussion / hints:

Fix patch:
diff --git a/DEVELOPING.md b/DEVELOPING.md
index 80a6be12..3cbcfc39 100644
--- a/DEVELOPING.md
+++ b/DEVELOPING.md
@@ -164,6 +164,22 @@ pip uninstall vunnel  #... if you already have vunnel installed in this virtual
 pip install -e .
 ```
 
+### Snapshot Tests
+
+In order to ensure that the same feed state from providers would make the same
+set of vulnerabilities, snapshot testing is used.
+
+Snapshot tests are run as part of ordinary unit tests, and will run during
+`make unit`.
+
+To update snapshots, run the following pytest command. (Note that this example
+is for the debian provider, and the test name and path will be different for
+other providers):
+
+``` sh
+pytest ./tests/unit/providers/debian/test_debian.py -k test_provider_via_snapshot --snapshot-update
+```
+
 ## Architecture
 
 Vunnel is a CLI tool that downloads and processes vulnerability data from various sources (in the codebase, these are called "providers").
diff --git a/poetry.lock b/poetry.lock
index f694fdb6..8bd8d180 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -1302,6 +1302,20 @@ files = [
 [package.dependencies]
 pytest = ">=3.7.0"
 
+[[package]]
+name = "pytest-snapshot"
+version = "0.9.0"
+description = "A plugin for snapshot testing with pytest."
+optional = false
+python-versions = ">=3.5"
+files = [
+    {file = "pytest-snapshot-0.9.0.tar.gz", hash = "sha256:c7013c3abc3e860f9feff899f8b4debe3708650d8d8242a61bf2625ff64db7f3"},
+    {file = "pytest_snapshot-0.9.0-py3-none-any.whl", hash = "sha256:4b9fe1c21c868fe53a545e4e3184d36bc1c88946e3f5c1d9dd676962a9b3d4ab"},
+]
+
+[package.dependencies]
+pytest = ">=3.0.0"
+
 [[package]]
 name = "pytest-sugar"
 version = "0.9.7"
@@ -2093,4 +2107,4 @@ testing = ["big-O", "jaraco.functools", "jaraco.itertools", "more-itertools", "p
 [metadata]
 lock-version = "2.0"
 python-versions = "^3.9"
-content-hash = "26f42c13f138b04e1bf7df0741a95735f0705d9fac1732d9094be69c61e3d10d"
+content-hash = "7e22045902b3f4932bc804edb4dd0cf606b1a5cbdfc6969eceda446249e37738"
diff --git a/pyproject.toml b/pyproject.toml
index fb0779d6..ea4747d5 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -58,6 +58,7 @@ mergedeep = "^1.3.4"
 future = "^0.18.3"
 importlib-metadata = "^6.1.0"
 xsdata = {extras = ["cli", "lxml", "soap"], version = ">=22.12,<24.0"}
+pytest-snapshot = "^0.9.0"
 
 [tool.poetry.group.dev.dependencies]
 pytest = "^7.2.2"


Test patch:
diff --git a/tests/conftest.py b/tests/conftest.py
index 1bd0761c..96c247ad 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -2,17 +2,21 @@
 
 import json
 import os
+from pathlib import Path
 import subprocess
 import uuid
+import os.path
+import shutil
 
 import jsonschema
 import pytest
 
 
 class WorkspaceHelper:
-    def __init__(self, root: str, name: str):
+    def __init__(self, root: str, name: str, snapshot):
         self.root = root
         self.name = name
+        self.snapshot = snapshot
 
     @property
     def metadata_path(self):
@@ -33,6 +37,13 @@ def result_files(self):
                 results.append(os.path.join(root, filename))
         return results
 
+    def _snapshot_files(self):
+        snapshot_files = []
+        for root, _dirs, files in os.walk(self.snapshot.snapshot_dir):
+            for filename in files:
+                snapshot_files.append(os.path.join(root, filename))
+        return snapshot_files
+
     def num_result_entries(self):
         return len(self.result_files())
 
@@ -62,6 +73,46 @@ def metadata_schema_valid(self) -> bool:
 
         return True
 
+    def copy_input_fixtures(self, mock_data_path: str):
+        shutil.copytree(mock_data_path, self.input_dir, dirs_exist_ok=True)
+
+    def assert_result_snapshots(self):
+        expected_files_to_test = set(self._snapshot_files())
+        missing_snapshot_files = []
+
+        for result_file in self.result_files():
+            # protection against test configuration not swapping to the flat file store strategy
+            assert result_file.endswith(".json")
+
+            with open(result_file) as f:
+                snapshot_path = result_file.split("results/")[-1]
+
+                snapshot_abs_path = os.path.join(self.snapshot.snapshot_dir, snapshot_path)
+
+                if not self.snapshot._snapshot_update and not os.path.exists(snapshot_abs_path):
+                    missing_snapshot_files.append(snapshot_abs_path)
+                else:
+                    self.snapshot.assert_match(f.read() + "\n", snapshot_path)
+
+                    if snapshot_abs_path in expected_files_to_test:
+                        expected_files_to_test.remove(snapshot_abs_path)
+
+        message_lines = []
+        if expected_files_to_test:
+            message_lines.append("existing snapshot files that were not asserted:")
+            for expected_snapshot_path in expected_files_to_test:
+                message_lines.append(f"  - {expected_snapshot_path}")
+
+        if missing_snapshot_files:
+            if message_lines:
+                message_lines.append("")
+            message_lines.append("missing snapshot files:")
+            for missing_snapshot_file in missing_snapshot_files:
+                message_lines.append(f"  - {missing_snapshot_file}")
+
+        if message_lines:
+            pytest.fail("\n".join(message_lines), pytrace=False)
+
 
 def load_json_schema(path: str) -> dict:
     with open(path) as f:
@@ -77,12 +128,16 @@ def get_schema_repo_path(url: str):
 
 
 class Helpers:
-    def __init__(self, request, tmpdir):
+    def __init__(self, request, tmpdir, snapshot):
         # current information about the running test
         # docs: https://docs.pytest.org/en/6.2.x/reference.html#std-fixture-request
         self.request = request
         self.tmpdir = tmpdir
 
+        # any snapshot tests should be stored in the same place
+        snapshot.snapshot_dir = self.local_dir("test-fixtures/snapshots")
+        self.snapshot = snapshot
+
     def local_dir(self, path: str):
         """
         Returns the path of a file relative to the current test file.
@@ -102,20 +157,26 @@ def local_dir(self, path: str):
         parent = os.path.realpath(os.path.dirname(current_test_filepath))
         return os.path.join(parent, path)
 
-    def provider_workspace_helper(self, name: str, create=True) -> WorkspaceHelper:
+    def provider_workspace_helper(self, name: str, create: bool = True, input_fixture: str | None = None) -> WorkspaceHelper:
         root = self.tmpdir
         if create:
             os.makedirs(root / name / "input")
             os.makedirs(root / name / "results")
-        return WorkspaceHelper(root, name)
+
+        h = WorkspaceHelper(root, name, self.snapshot)
+
+        if input_fixture:
+            h.copy_input_fixtures(self.local_dir(input_fixture))
+
+        return h
 
 
 @pytest.fixture()
-def helpers(request, tmpdir):
+def helpers(request, tmpdir, snapshot):
     """
     Returns a common set of helper functions for tests.
     """
-    return Helpers(request, tmpdir)
+    return Helpers(request, tmpdir, snapshot)
 
 
 def git_root() -> str:
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:10/cve-2005-3111.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:10/cve-2005-3111.json
new file mode 100644
index 00000000..6c01756a
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:10/cve-2005-3111.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:10/cve-2005-3111","item":{"Vulnerability":{"Severity":"Medium","NamespaceName":"debian:10","FixedIn":[{"Name":"backupninja","NamespaceName":"debian:10","VersionFormat":"dpkg","Version":"0.8-2","VendorAdvisory":{"NoAdvisory":false,"AdvisorySummary":[]}}],"Link":"https://security-tracker.debian.org/tracker/CVE-2005-3111","Description":"The handler code for backupninja 0.8 and earlier creates temporary files with predictable filenames, which allows local users to modify arbitrary files via a symlink attack.","Metadata":{},"Name":"CVE-2005-3111","CVSS":[]}}}
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:10/cve-2007-2383.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:10/cve-2007-2383.json
new file mode 100644
index 00000000..4ddb8007
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:10/cve-2007-2383.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:10/cve-2007-2383","item":{"Vulnerability":{"Severity":"Negligible","NamespaceName":"debian:10","FixedIn":[],"Link":"https://security-tracker.debian.org/tracker/CVE-2007-2383","Description":"The Prototype (prototypejs) framework before 1.5.1 RC3 exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka \"JavaScript Hijacking.\"","Metadata":{},"Name":"CVE-2007-2383","CVSS":[]}}}
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:10/cve-2008-7220.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:10/cve-2008-7220.json
new file mode 100644
index 00000000..97cf64de
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:10/cve-2008-7220.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:10/cve-2008-7220","item":{"Vulnerability":{"Severity":"High","NamespaceName":"debian:10","FixedIn":[{"Name":"prototypejs","NamespaceName":"debian:10","VersionFormat":"dpkg","Version":"1.6.0.2-1","VendorAdvisory":{"NoAdvisory":false,"AdvisorySummary":[]}}],"Link":"https://security-tracker.debian.org/tracker/CVE-2008-7220","Description":"Unspecified vulnerability in Prototype JavaScript framework (prototypejs) before 1.6.0.2 allows attackers to make \"cross-site ajax requests\" via unknown vectors.","Metadata":{},"Name":"CVE-2008-7220","CVSS":[]}}}
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:10/cve-2013-1444.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:10/cve-2013-1444.json
new file mode 100644
index 00000000..2e07c5f0
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:10/cve-2013-1444.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:10/cve-2013-1444","item":{"Vulnerability":{"Severity":"Low","NamespaceName":"debian:10","FixedIn":[{"Name":"txt2man","NamespaceName":"debian:10","VersionFormat":"dpkg","Version":"1.5.5-4.1","VendorAdvisory":{"NoAdvisory":false,"AdvisorySummary":[]}}],"Link":"https://security-tracker.debian.org/tracker/CVE-2013-1444","Description":"A certain Debian patch for txt2man 1.5.5, as used in txt2man 1.5.5-2, 1.5.5-4, and others, allows local users to overwrite arbitrary files via a symlink attack on /tmp/2222.","Metadata":{},"Name":"CVE-2013-1444","CVSS":[]}}}
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:10/cve-2022-0456.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:10/cve-2022-0456.json
new file mode 100644
index 00000000..5869c61c
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:10/cve-2022-0456.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:10/cve-2022-0456","item":{"Vulnerability":{"Severity":"Negligible","NamespaceName":"debian:10","FixedIn":[{"Name":"chromium","NamespaceName":"debian:10","VersionFormat":"dpkg","Version":"None","VendorAdvisory":{"NoAdvisory":false,"AdvisorySummary":[]}}],"Link":"https://security-tracker.debian.org/tracker/CVE-2022-0456","Description":"","Metadata":{},"Name":"CVE-2022-0456","CVSS":[]}}}
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:11/cve-2022-0456.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:11/cve-2022-0456.json
new file mode 100644
index 00000000..6f54bf15
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:11/cve-2022-0456.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:11/cve-2022-0456","item":{"Vulnerability":{"Severity":"Unknown","NamespaceName":"debian:11","FixedIn":[{"Name":"chromium","NamespaceName":"debian:11","VersionFormat":"dpkg","Version":"98.0.4758.80-1~deb11u1","VendorAdvisory":{"NoAdvisory":false,"AdvisorySummary":[]}}],"Link":"https://security-tracker.debian.org/tracker/CVE-2022-0456","Description":"","Metadata":{},"Name":"CVE-2022-0456","CVSS":[]}}}
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:12/cve-2022-0456.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:12/cve-2022-0456.json
new file mode 100644
index 00000000..150ab800
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:12/cve-2022-0456.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:12/cve-2022-0456","item":{"Vulnerability":{"Severity":"Unknown","NamespaceName":"debian:12","FixedIn":[{"Name":"chromium","NamespaceName":"debian:12","VersionFormat":"dpkg","Version":"98.0.4758.80-1","VendorAdvisory":{"NoAdvisory":false,"AdvisorySummary":[]}}],"Link":"https://security-tracker.debian.org/tracker/CVE-2022-0456","Description":"","Metadata":{},"Name":"CVE-2022-0456","CVSS":[]}}}
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2004-1653.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2004-1653.json
new file mode 100644
index 00000000..0e5c9ae5
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2004-1653.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:7/cve-2004-1653","item":{"Vulnerability":{"Description":"","FixedIn":[],"Link":"https://security-tracker.debian.org/tracker/CVE-2004-1653","Metadata":{"NVD":{"CVSSv2":{"Score":6.4}}},"Name":"CVE-2004-1653","NamespaceName":"debian:7","Severity":"Negligible"}}}
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2005-3330.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2005-3330.json
new file mode 100644
index 00000000..5d0c5001
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2005-3330.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:7/cve-2005-3330","item":{"Vulnerability":{"Description":"","FixedIn":[],"Link":"https://security-tracker.debian.org/tracker/CVE-2005-3330","Metadata":{"NVD":{"CVSSv2":{"Score":7.5}}},"Name":"CVE-2005-3330","NamespaceName":"debian:7","Severity":"Negligible"}}}
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2007-3072.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2007-3072.json
new file mode 100644
index 00000000..16e40d91
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2007-3072.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:7/cve-2007-3072","item":{"Vulnerability":{"Description":"","FixedIn":[],"Link":"https://security-tracker.debian.org/tracker/CVE-2007-3072","Metadata":{"NVD":{"CVSSv2":{"Score":7.1,"Vectors":"AV:N/AC:M/Au:N/C:C/I:N"}}},"Name":"CVE-2007-3072","NamespaceName":"debian:7","Severity":"Negligible"}}}
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2011-1758.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2011-1758.json
new file mode 100644
index 00000000..79e629bf
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2011-1758.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:7/cve-2011-1758","item":{"Vulnerability":{"Description":"","FixedIn":[],"Link":"https://security-tracker.debian.org/tracker/CVE-2011-1758","Metadata":{"NVD":{"CVSSv2":{"Score":3.7,"Vectors":"AV:L/AC:H/Au:N/C:P/I:P"}}},"Name":"CVE-2011-1758","NamespaceName":"debian:7","Severity":"Negligible"}}}
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2013-2188.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2013-2188.json
new file mode 100644
index 00000000..be27d9d7
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2013-2188.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:7/cve-2013-2188","item":{"Vulnerability":{"Description":"","FixedIn":[],"Link":"https://security-tracker.debian.org/tracker/CVE-2013-2188","Metadata":{"NVD":{"CVSSv2":{"Score":4.7,"Vectors":"AV:L/AC:M/Au:N/C:N/I:N"}}},"Name":"CVE-2013-2188","NamespaceName":"debian:7","Severity":"Negligible"}}}
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2013-7171.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2013-7171.json
new file mode 100644
index 00000000..91757705
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2013-7171.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:7/cve-2013-7171","item":{"Vulnerability":{"Description":"","FixedIn":[],"Link":"https://security-tracker.debian.org/tracker/CVE-2013-7171","Metadata":{},"Name":"CVE-2013-7171","NamespaceName":"debian:7","Severity":"Negligible"}}}
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2013-7353.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2013-7353.json
new file mode 100644
index 00000000..b7950d1c
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2013-7353.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:7/cve-2013-7353","item":{"Vulnerability":{"Description":"","FixedIn":[],"Link":"https://security-tracker.debian.org/tracker/CVE-2013-7353","Metadata":{"NVD":{"CVSSv2":{"Score":5,"Vectors":"AV:N/AC:L/Au:N/C:N/I:N"}}},"Name":"CVE-2013-7353","NamespaceName":"debian:7","Severity":"Negligible"}}}
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2014-3230.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2014-3230.json
new file mode 100644
index 00000000..1d88b427
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2014-3230.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:7/cve-2014-3230","item":{"Vulnerability":{"Description":"","FixedIn":[],"Link":"https://security-tracker.debian.org/tracker/CVE-2014-3230","Metadata":{},"Name":"CVE-2014-3230","NamespaceName":"debian:7","Severity":"Negligible"}}}
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2015-4170.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2015-4170.json
new file mode 100644
index 00000000..53345d6e
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2015-4170.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:7/cve-2015-4170","item":{"Vulnerability":{"Description":"","FixedIn":[],"Link":"https://security-tracker.debian.org/tracker/CVE-2015-4170","Metadata":{"NVD":{"CVSSv2":{"Score":4.7,"Vectors":"AV:L/AC:M/Au:N/C:N/I:N"}}},"Name":"CVE-2015-4170","NamespaceName":"debian:7","Severity":"Negligible"}}}
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2015-4176.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2015-4176.json
new file mode 100644
index 00000000..71a92ae6
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2015-4176.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:7/cve-2015-4176","item":{"Vulnerability":{"Description":"","FixedIn":[],"Link":"https://security-tracker.debian.org/tracker/CVE-2015-4176","Metadata":{"NVD":{"CVSSv2":{"Score":2.1,"Vectors":"AV:L/AC:L/Au:N/C:N/I:P"}}},"Name":"CVE-2015-4176","NamespaceName":"debian:7","Severity":"Negligible"}}}
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2015-4177.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2015-4177.json
new file mode 100644
index 00000000..37576b58
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2015-4177.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:7/cve-2015-4177","item":{"Vulnerability":{"Description":"","FixedIn":[],"Link":"https://security-tracker.debian.org/tracker/CVE-2015-4177","Metadata":{"NVD":{"CVSSv2":{"Score":4.9,"Vectors":"AV:L/AC:L/Au:N/C:N/I:N"}}},"Name":"CVE-2015-4177","NamespaceName":"debian:7","Severity":"Negligible"}}}
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2016-4450.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2016-4450.json
new file mode 100644
index 00000000..71d82508
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2016-4450.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:7/cve-2016-4450","item":{"Vulnerability":{"Description":"","FixedIn":[],"Link":"https://security-tracker.debian.org/tracker/CVE-2016-4450","Metadata":{"NVD":{"CVSSv2":{"Score":5,"Vectors":"AV:N/AC:L/Au:N/C:N/I:N"}}},"Name":"CVE-2016-4450","NamespaceName":"debian:7","Severity":"Negligible"}}}
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2016-5105.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2016-5105.json
new file mode 100644
index 00000000..32bc1adc
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2016-5105.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:7/cve-2016-5105","item":{"Vulnerability":{"Description":"","FixedIn":[],"Link":"https://security-tracker.debian.org/tracker/CVE-2016-5105","Metadata":{"NVD":{"CVSSv2":{"Score":1.9,"Vectors":"AV:L/AC:M/Au:N/C:P/I:N"}}},"Name":"CVE-2016-5105","NamespaceName":"debian:7","Severity":"Negligible"}}}
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2016-5106.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2016-5106.json
new file mode 100644
index 00000000..a31f2c96
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2016-5106.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:7/cve-2016-5106","item":{"Vulnerability":{"Description":"","FixedIn":[],"Link":"https://security-tracker.debian.org/tracker/CVE-2016-5106","Metadata":{"NVD":{"CVSSv2":{"Score":1.5,"Vectors":"AV:L/AC:M/Au:S/C:N/I:N"}}},"Name":"CVE-2016-5106","NamespaceName":"debian:7","Severity":"Negligible"}}}
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2016-5107.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2016-5107.json
new file mode 100644
index 00000000..0c1a69cf
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2016-5107.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:7/cve-2016-5107","item":{"Vulnerability":{"Description":"","FixedIn":[],"Link":"https://security-tracker.debian.org/tracker/CVE-2016-5107","Metadata":{"NVD":{"CVSSv2":{"Score":1.5,"Vectors":"AV:L/AC:M/Au:S/C:N/I:N"}}},"Name":"CVE-2016-5107","NamespaceName":"debian:7","Severity":"Negligible"}}}
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2016-9812.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2016-9812.json
new file mode 100644
index 00000000..9e0e2c71
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2016-9812.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:7/cve-2016-9812","item":{"Vulnerability":{"Description":"","FixedIn":[],"Link":"https://security-tracker.debian.org/tracker/CVE-2016-9812","Metadata":{"NVD":{"CVSSv2":{"Score":5,"Vectors":"AV:N/AC:L/Au:N/C:N/I:N"}}},"Name":"CVE-2016-9812","NamespaceName":"debian:7","Severity":"Negligible"}}}
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2016-9816.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2016-9816.json
new file mode 100644
index 00000000..3f53df35
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:7/cve-2016-9816.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:7/cve-2016-9816","item":{"Vulnerability":{"Description":"","FixedIn":[],"Link":"https://security-tracker.debian.org/tracker/CVE-2016-9816","Metadata":{"NVD":{"CVSSv2":{"Score":4.9,"Vectors":"AV:L/AC:L/Au:N/C:N/I:N"}}},"Name":"CVE-2016-9816","NamespaceName":"debian:7","Severity":"Negligible"}}}
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:8/cve-2005-3111.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:8/cve-2005-3111.json
new file mode 100644
index 00000000..0f13457a
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:8/cve-2005-3111.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:8/cve-2005-3111","item":{"Vulnerability":{"Severity":"Medium","NamespaceName":"debian:8","FixedIn":[{"Name":"backupninja","NamespaceName":"debian:8","VersionFormat":"dpkg","Version":"0.8-2","VendorAdvisory":{"NoAdvisory":false,"AdvisorySummary":[]}}],"Link":"https://security-tracker.debian.org/tracker/CVE-2005-3111","Description":"The handler code for backupninja 0.8 and earlier creates temporary files with predictable filenames, which allows local users to modify arbitrary files via a symlink attack.","Metadata":{},"Name":"CVE-2005-3111","CVSS":[]}}}
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:8/cve-2007-2383.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:8/cve-2007-2383.json
new file mode 100644
index 00000000..30adc35b
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:8/cve-2007-2383.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:8/cve-2007-2383","item":{"Vulnerability":{"Severity":"Negligible","NamespaceName":"debian:8","FixedIn":[],"Link":"https://security-tracker.debian.org/tracker/CVE-2007-2383","Description":"The Prototype (prototypejs) framework before 1.5.1 RC3 exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka \"JavaScript Hijacking.\"","Metadata":{},"Name":"CVE-2007-2383","CVSS":[]}}}
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:8/cve-2008-7220.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:8/cve-2008-7220.json
new file mode 100644
index 00000000..96f046ca
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:8/cve-2008-7220.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:8/cve-2008-7220","item":{"Vulnerability":{"Severity":"High","NamespaceName":"debian:8","FixedIn":[{"Name":"prototypejs","NamespaceName":"debian:8","VersionFormat":"dpkg","Version":"1.6.0.2-1","VendorAdvisory":{"NoAdvisory":false,"AdvisorySummary":[]}}],"Link":"https://security-tracker.debian.org/tracker/CVE-2008-7220","Description":"Unspecified vulnerability in Prototype JavaScript framework (prototypejs) before 1.6.0.2 allows attackers to make \"cross-site ajax requests\" via unknown vectors.","Metadata":{},"Name":"CVE-2008-7220","CVSS":[]}}}
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:8/cve-2013-1444.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:8/cve-2013-1444.json
new file mode 100644
index 00000000..1b2cc2ff
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:8/cve-2013-1444.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:8/cve-2013-1444","item":{"Vulnerability":{"Severity":"Low","NamespaceName":"debian:8","FixedIn":[{"Name":"txt2man","NamespaceName":"debian:8","VersionFormat":"dpkg","Version":"1.5.5-4.1","VendorAdvisory":{"NoAdvisory":false,"AdvisorySummary":[]}}],"Link":"https://security-tracker.debian.org/tracker/CVE-2013-1444","Description":"A certain Debian patch for txt2man 1.5.5, as used in txt2man 1.5.5-2, 1.5.5-4, and others, allows local users to overwrite arbitrary files via a symlink attack on /tmp/2222.","Metadata":{},"Name":"CVE-2013-1444","CVSS":[]}}}
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:9/cve-2005-3111.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:9/cve-2005-3111.json
new file mode 100644
index 00000000..9f92e6d0
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:9/cve-2005-3111.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:9/cve-2005-3111","item":{"Vulnerability":{"Severity":"Medium","NamespaceName":"debian:9","FixedIn":[{"Name":"backupninja","NamespaceName":"debian:9","VersionFormat":"dpkg","Version":"0.8-2","VendorAdvisory":{"NoAdvisory":false,"AdvisorySummary":[]}}],"Link":"https://security-tracker.debian.org/tracker/CVE-2005-3111","Description":"The handler code for backupninja 0.8 and earlier creates temporary files with predictable filenames, which allows local users to modify arbitrary files via a symlink attack.","Metadata":{},"Name":"CVE-2005-3111","CVSS":[]}}}
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:9/cve-2007-2383.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:9/cve-2007-2383.json
new file mode 100644
index 00000000..0be48889
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:9/cve-2007-2383.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:9/cve-2007-2383","item":{"Vulnerability":{"Severity":"Negligible","NamespaceName":"debian:9","FixedIn":[],"Link":"https://security-tracker.debian.org/tracker/CVE-2007-2383","Description":"The Prototype (prototypejs) framework before 1.5.1 RC3 exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka \"JavaScript Hijacking.\"","Metadata":{},"Name":"CVE-2007-2383","CVSS":[]}}}
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:9/cve-2008-7220.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:9/cve-2008-7220.json
new file mode 100644
index 00000000..89e5a29f
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:9/cve-2008-7220.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:9/cve-2008-7220","item":{"Vulnerability":{"Severity":"High","NamespaceName":"debian:9","FixedIn":[{"Name":"prototypejs","NamespaceName":"debian:9","VersionFormat":"dpkg","Version":"1.6.0.2-1","VendorAdvisory":{"NoAdvisory":false,"AdvisorySummary":[]}}],"Link":"https://security-tracker.debian.org/tracker/CVE-2008-7220","Description":"Unspecified vulnerability in Prototype JavaScript framework (prototypejs) before 1.6.0.2 allows attackers to make \"cross-site ajax requests\" via unknown vectors.","Metadata":{},"Name":"CVE-2008-7220","CVSS":[]}}}
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:9/cve-2013-1444.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:9/cve-2013-1444.json
new file mode 100644
index 00000000..2ff71bbd
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:9/cve-2013-1444.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:9/cve-2013-1444","item":{"Vulnerability":{"Severity":"Low","NamespaceName":"debian:9","FixedIn":[{"Name":"txt2man","NamespaceName":"debian:9","VersionFormat":"dpkg","Version":"1.5.5-4.1","VendorAdvisory":{"NoAdvisory":false,"AdvisorySummary":[]}}],"Link":"https://security-tracker.debian.org/tracker/CVE-2013-1444","Description":"A certain Debian patch for txt2man 1.5.5, as used in txt2man 1.5.5-2, 1.5.5-4, and others, allows local users to overwrite arbitrary files via a symlink attack on /tmp/2222.","Metadata":{},"Name":"CVE-2013-1444","CVSS":[]}}}
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:9/cve-2022-0456.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:9/cve-2022-0456.json
new file mode 100644
index 00000000..c6cad8ed
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:9/cve-2022-0456.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:9/cve-2022-0456","item":{"Vulnerability":{"Severity":"Negligible","NamespaceName":"debian:9","FixedIn":[{"Name":"chromium","NamespaceName":"debian:9","VersionFormat":"dpkg","Version":"None","VendorAdvisory":{"NoAdvisory":false,"AdvisorySummary":[]}}],"Link":"https://security-tracker.debian.org/tracker/CVE-2022-0456","Description":"","Metadata":{},"Name":"CVE-2022-0456","CVSS":[]}}}
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:unstable/cve-2005-3111.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:unstable/cve-2005-3111.json
new file mode 100644
index 00000000..2593a80c
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:unstable/cve-2005-3111.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:unstable/cve-2005-3111","item":{"Vulnerability":{"Severity":"Medium","NamespaceName":"debian:unstable","FixedIn":[{"Name":"backupninja","NamespaceName":"debian:unstable","VersionFormat":"dpkg","Version":"0.8-2","VendorAdvisory":{"NoAdvisory":false,"AdvisorySummary":[]}}],"Link":"https://security-tracker.debian.org/tracker/CVE-2005-3111","Description":"The handler code for backupninja 0.8 and earlier creates temporary files with predictable filenames, which allows local users to modify arbitrary files via a symlink attack.","Metadata":{},"Name":"CVE-2005-3111","CVSS":[]}}}
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:unstable/cve-2007-2383.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:unstable/cve-2007-2383.json
new file mode 100644
index 00000000..a954a39b
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:unstable/cve-2007-2383.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:unstable/cve-2007-2383","item":{"Vulnerability":{"Severity":"Negligible","NamespaceName":"debian:unstable","FixedIn":[],"Link":"https://security-tracker.debian.org/tracker/CVE-2007-2383","Description":"The Prototype (prototypejs) framework before 1.5.1 RC3 exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka \"JavaScript Hijacking.\"","Metadata":{},"Name":"CVE-2007-2383","CVSS":[]}}}
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:unstable/cve-2008-7220.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:unstable/cve-2008-7220.json
new file mode 100644
index 00000000..d90119cb
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:unstable/cve-2008-7220.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:unstable/cve-2008-7220","item":{"Vulnerability":{"Severity":"High","NamespaceName":"debian:unstable","FixedIn":[{"Name":"prototypejs","NamespaceName":"debian:unstable","VersionFormat":"dpkg","Version":"1.6.0.2-1","VendorAdvisory":{"NoAdvisory":false,"AdvisorySummary":[]}}],"Link":"https://security-tracker.debian.org/tracker/CVE-2008-7220","Description":"Unspecified vulnerability in Prototype JavaScript framework (prototypejs) before 1.6.0.2 allows attackers to make \"cross-site ajax requests\" via unknown vectors.","Metadata":{},"Name":"CVE-2008-7220","CVSS":[]}}}
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:unstable/cve-2013-1444.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:unstable/cve-2013-1444.json
new file mode 100644
index 00000000..b1b53ddd
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:unstable/cve-2013-1444.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:unstable/cve-2013-1444","item":{"Vulnerability":{"Severity":"Low","NamespaceName":"debian:unstable","FixedIn":[{"Name":"txt2man","NamespaceName":"debian:unstable","VersionFormat":"dpkg","Version":"1.5.5-4.1","VendorAdvisory":{"NoAdvisory":false,"AdvisorySummary":[]}}],"Link":"https://security-tracker.debian.org/tracker/CVE-2013-1444","Description":"A certain Debian patch for txt2man 1.5.5, as used in txt2man 1.5.5-2, 1.5.5-4, and others, allows local users to overwrite arbitrary files via a symlink attack on /tmp/2222.","Metadata":{},"Name":"CVE-2013-1444","CVSS":[]}}}
diff --git a/tests/unit/providers/debian/test-fixtures/snapshots/debian:unstable/cve-2022-0456.json b/tests/unit/providers/debian/test-fixtures/snapshots/debian:unstable/cve-2022-0456.json
new file mode 100644
index 00000000..d74f2de5
--- /dev/null
+++ b/tests/unit/providers/debian/test-fixtures/snapshots/debian:unstable/cve-2022-0456.json
@@ -0,0 +1,1 @@
+{"schema":"https://raw.githubusercontent.com/anchore/vunnel/main/schema/vulnerability/os/schema-1.0.0.json","identifier":"debian:unstable/cve-2022-0456","item":{"Vulnerability":{"Severity":"Unknown","NamespaceName":"debian:unstable","FixedIn":[{"Name":"chromium","NamespaceName":"debian:unstable","VersionFormat":"dpkg","Version":"98.0.4758.80-1","VendorAdvisory":{"NoAdvisory":false,"AdvisorySummary":[]}}],"Link":"https://security-tracker.debian.org/tracker/CVE-2022-0456","Description":"","Metadata":{},"Name":"CVE-2022-0456","CVSS":[]}}}
diff --git a/tests/unit/providers/debian/test_debian.py b/tests/unit/providers/debian/test_debian.py
index 138793ae..aad99f80 100644
--- a/tests/unit/providers/debian/test_debian.py
+++ b/tests/unit/providers/debian/test_debian.py
@@ -116,18 +116,19 @@ def test_get_legacy_records(self, tmpdir, helpers, disable_get_requests):
 
 
 def test_provider_schema(helpers, disable_get_requests, monkeypatch):
-    workspace = helpers.provider_workspace_helper(name=Provider.name())
+    workspace = helpers.provider_workspace_helper(
+        name=Provider.name(),
+        input_fixture="test-fixtures/input",
+    )
 
     c = Config()
+    # keep all of the default values for the result store, but override the strategy
     c.runtime.result_store = result.StoreStrategy.FLAT_FILE
     p = Provider(
         root=workspace.root,
         config=c,
     )
 
-    mock_data_path = helpers.local_dir("test-fixtures/input")
-    shutil.copytree(mock_data_path, workspace.input_dir, dirs_exist_ok=True)
-
     def mock_download():
         return None
 
@@ -140,3 +141,28 @@ def mock_download():
     expected = 38
     assert workspace.num_result_entries() == expected
     assert workspace.result_schemas_valid(require_entries=True)
+
+
+def test_provider_via_snapshot(helpers, disable_get_requests, monkeypatch):
+    workspace = helpers.provider_workspace_helper(
+        name=Provider.name(),
+        input_fixture="test-fixtures/input",
+    )
+
+    c = Config()
+    # keep all of the default values for the result store, but override the strategy
+    c.runtime.result_store = result.StoreStrategy.FLAT_FILE
+    p = Provider(
+        root=workspace.root,
+        config=c,
+    )
+
+    def mock_download():
+        return None
+
+    monkeypatch.setattr(p.parser, "_download_json", mock_download)
+    monkeypatch.setattr(p.parser, "_download_dsa", mock_download)
+
+    p.update(None)
+
+    workspace.assert_result_snapshots()