#!/usr/bin/env bash
# SAFE DEFENSIVE VALIDATOR — KERNEL VERSION + KNOWN CVE SURFACE PROOF
#
# Purpose: Captures local kernel version (uname -r) and checks against
#          a small built-in list of high-impact known kernel CVEs.
#          Purely informational — no exploitation.
#
# Safety: Read-only. Bounded. Cross-platform (Linux strong, macOS, Windows via WSL).
#
# Generated by Vigil safe-poc-generator (Phase 1, template A — defensive only).

set -euo pipefail

STARTED=$(date -u +%Y-%m-%dT%H:%M:%SZ)
KERNEL=$(uname -r 2>/dev/null || echo "unknown")
OS=$(uname -s 2>/dev/null || echo "unknown")

echo '{
  "validator": "kernel-version-validator",
  "schemaVersion": "1.0.0",
  "generatedBy": "Vigil safe-poc-generator (Phase 1, template A)",
  "startedAt": "'"$STARTED"'",
  "kernel": "'"$KERNEL"'",
  "os": "'"$OS"'",
  "knownHighImpactMatches": [],'

# Very small curated list of example high-severity kernel issues (illustrative only)
KNOWN=(
  "CVE-2024-1086:use-after-free in nf_tables"
  "CVE-2023-32233:use-after-free in ksmbd"
  "CVE-2022-0847:Dirty Pipe"
)

MATCHES=()
for c in "${KNOWN[@]}"; do
  if echo "$KERNEL" | grep -qi "$(echo "$c" | cut -d: -f1 | tr -d 'CVE-')"; then
    MATCHES+=("\"$c\"")
  fi
done

echo '  "matches": ['"$(IFS=,; echo "${MATCHES[*]}")"'],
  "completedAt": "'$(date -u +%Y-%m-%dT%H:%M:%SZ)'",
  "conclusion": "Kernel version captured. Cross-reference with vendor advisories for your exact distro."
}'
exit 0