scanner: undfscand v1.0.0 — UNDF patch verification scanner (C/pthreads)

Self-contained C scanner that reads UNDF-REGISTRY.json, parses patch .md
files to extract file paths and code patterns, walks a target directory
tree, and classifies each registered defect as PATCHED/UNPATCHED/UNKNOWN/
NOT_FOUND. Thread pool via pthreads. Bundled MD5+SHA256, no external deps.

.gitlab-ci.yml

@@ -0,0 +1,41 @@
+stages:
+  - build
+  - scan
+
+build-scanner:
+  stage: build
+  script:
+    - make -C scanner
+  artifacts:
+    paths:
+      - scanner/undfscand
+    expire_in: 1 hour
+
+undf-scan:
+  stage: scan
+  needs: [build-scanner]
+  script:
+    - ./scanner/undfscand
+        --registry UNDF-REGISTRY.json
+        --defects defects/
+        --target ${CI_PROJECT_DIR}
+        --threads 4
+        --format json
+        --output scan-report.json
+    - |
+      python3 -c "
+      import json, sys
+      r = json.load(open('scan-report.json'))
+      s = r['summary']
+      print(f'UNDF Scan: {s[\"total\"]} checked | {s[\"patched\"]} patched | {s[\"unpatched\"]} UNPATCHED | {s[\"not_found\"]} not_found')
+      unpatched = [f for f in r['findings'] if f['status'] == 'UNPATCHED']
+      for f in unpatched:
+          print(f'  !! {f[\"undf\"]} {f[\"defect_id\"]}: {f[\"evidence\"]}')
+      sys.exit(1 if unpatched else 0)
+      "
+  artifacts:
+    when: always
+    paths:
+      - scan-report.json
+    expire_in: 30 days
+  allow_failure: true

Makefile

@@ -63,3 +63,30 @@ TOPDIR := $(strip $(patsubst %/, %, $(dir $(makefile_path))))
 
 # ... and then we can include the real makefile to bootstrap the build
 include $(TOPDIR)/make/PreInit.gmk
+
+# ============================================================
+# UNDF Scanner targets (independent of JDK build system)
+# ============================================================
+
+scanner/undfscand: scanner/undfscand.c
+	$(MAKE) -C scanner
+
+scan-local: scanner/undfscand
+	./scanner/undfscand \
+	  --registry UNDF-REGISTRY.json \
+	  --defects defects/ \
+	  --target $(HOME)/git \
+	  --threads 8 \
+	  --output scan-report.json
+	@echo "Report: scan-report.json"
+
+scan-unsandbox: scanner/undfscand
+	./scanner/undfscand \
+	  --registry UNDF-REGISTRY.json \
+	  --defects defects/ \
+	  --target /home/fox/git \
+	  --threads 8 \
+	  --format json \
+	  --output scan-report-$(shell date +%Y%m%d-%H%M%S).json
+
+.PHONY: scan-local scan-unsandbox

scanner/Makefile

@@ -0,0 +1,19 @@
+CC = gcc
+CFLAGS = -O2 -Wall -Wextra -std=c11 -D_POSIX_C_SOURCE=200809L
+LDFLAGS = -lpthread
+
+TARGET = undfscand
+SRC = undfscand.c
+
+all: $(TARGET)
+
+$(TARGET): $(SRC)
+	$(CC) $(CFLAGS) -o $@ $< $(LDFLAGS)
+
+clean:
+	rm -f $(TARGET)
+
+install: $(TARGET)
+	install -m 755 $(TARGET) /usr/local/bin/
+
+.PHONY: all clean install