feat: integrate RapidFort advisory matching for their curated images

[vaibhav-rf]

Summary

Adds a dedicated RapidFort matcher that activates when the scanned image carries
a maintainer=RapidFort* Docker label. RapidFort advisories are stored under
rapidfort-{os}:{version} namespaces (e.g. rapidfort-ubuntu:20.04) — fully
isolated from standard distro scans so non-RF images are never affected.

Supported base distros: Ubuntu (dpkg), Alpine (apk), Red Hat (rpm).

Changes

New: grype/matcher/rapidfort/

File	Purpose
matcher.go	Core matcher: upstream + binary lookups, RPM release-identifier filtering, already-fixed suppression, dedup
label.go	IsRapidFortImage — detects RF-curated images via maintainer label
matcher_test.go	Unit tests: release identifier detection, RPM release matching, distro version mapping, already-fixed filter
label_test.go	IsRapidFortImage edge cases: nil source, non-image, case-insensitive key/value

Modified: existing packages

File	Change
grype/matcher/matchers.go	ApplySelectionPolicy replaces dpkg/apk/rpm matchers with RapidFortMatcher for RF images; Java/stock matchers are preserved
grype/matcher/matchers_test.go	Tests for selection policy: RF image, non-RF image, no source
grype/match/matcher_type.go	Register RapidFortMatcher type (excluded from AllMatcherTypes — it is a conditional override)
grype/distro/type.go	Add RapidFortUbuntu, RapidFortAlpine, RapidFortRedHat distro types with IDMapping entries
grype/db/internal/provider/unmarshal/os_vulnerability.go	Add Identifier field to OSFixedIn for per-release RPM advisory routing
grype/db/v6/build/transformers/os/transform.go	getPackageType maps RF distros; getFix emits release-identifier advisory references from Identifier field

Test fixtures

File	Purpose
test-fixtures/rapidfort-ubuntu-20.04.json	Transform test: Ubuntu dpkg advisory with VulnerableRange and fix availability
test-fixtures/rapidfort-redhat-9.json	Transform test: Red Hat rpm advisory with el9 (unfixed) and fc36 (fixed) entries

Design notes

Namespace isolation — The RF matcher queries rapidfort-{os}:{version} namespaces
that vunnel emits exclusively for RF advisories. Standard distro matchers (dpkg/apk/rpm)
never see these namespaces, so there is zero cross-contamination.

RPM release-identifier routing — Red Hat advisories carry per-release Identifier
fields (e.g. el9, fc36). The matcher derives the installed release from the package
version suffix (.el9, .fc41, .rf) and filters to advisories with a matching
release-identifier:* advisory reference. Unknown release identifiers fall back to
matching el* advisories.

Matcher activation — ApplySelectionPolicy in matchers.go checks
IsRapidFortImage and, when true, replaces dpkg/apk/rpm matchers with a single
RapidFortMatcher. This avoids double-reporting and keeps RF advisory logic
self-contained.

Test plan

• go test ./grype/matcher/rapidfort/... — all matcher and label tests pass
• go test ./grype/matcher/... — selection policy tests pass
• go test ./grype/db/v6/build/transformers/os/... — transform tests pass for both RF fixtures
• go test ./grype/distro/... — distro type registration passes
• Scan a RapidFort-curated image: verify rapidfort-matcher appears in match details
• Scan a non-RapidFort image: verify rapidfort-matcher is absent from match details

[willmurphyscode]

Hi @vaibhav-rf is there a publicly pullable test image I can try this out on?

[ravinder-rapidfort]

Hi @willmurphyscode,

Thank you for reaching out regarding the test images. We are currently in the process of creating them and will share them with you shortly.

These images will include coverage across all relevant operating systems: Alpine, Ubuntu, and Red Hat to support comprehensive end-to-end testing of the PRs.

Appreciate your patience.

Thanks Again.

[ravinder-rapidfort]

Hi @willmurphyscode,

Follow-up on my earlier message - the test images have been created and pushed. You can pull them using:

docker pull quay.io/rapidfort/rf-advisory/test1:20260521
docker pull quay.io/rapidfort/rf-advisory/test2:20260521
docker pull quay.io/rapidfort/rf-advisory/test3:20260521

These cover Alpine, Ubuntu, and Red Hat for end-to-end testing of the PRs. Let me know if you run into any issues pulling them.

Thanks!

[vaibhav-rf]

Hi @willmurphyscode

Just checking in on the test images we shared earlier. Were you able to pull them and validate the PRs?

Please let us know if you encountered any issues during testing or if there's any additional information we can provide. Looking forward to hearing your feedback.

Thanks!

[ravinder-rapidfort]

Hi @willmurphyscode,

Circling back on this, we haven't heard back since sharing the test images and PRs for review. Is there anything we can do on our end to help move this forward, or any additional information you need?

Happy to assist however we can.

Thanks!

[willmurphyscode]

Hi @ravinder-rapidfort thanks for the ping! I hope to take a look at this pretty soon.

[ravinder-rapidfort]

Hi @willmurphyscode

Thanks for the update! Just checking in to see if you've had a chance to take a look. Let us know if anything comes up happy to help.