Merge ~alexmurray/ubuntu-cve-tracker:always-add-cve-entries-for-standard-ubuntu-releases into ubuntu-cve-tracker:master

[Alex Murray]

This will add entries like:

bionic_pkg: DNE

When a package doesn't exist on an older release like bionic, but *won't* add say an entry like:

esm-infra/xenial: DNE

to avoid cluttering CVE files with too many empty entries.

[Steve Beattie (sbeattie)]

This LGTM, thanks!

review: Approve

[Alex Murray (alexmurray)]

Thanks Steve :)

diff --git a/scripts/active_edit b/scripts/active_edit
index 3371340..8f65066 100755
--- a/scripts/active_edit
+++ b/scripts/active_edit
@@ -153,7 +153,13 @@ def update_cve(cve, pkgname, fixed_in=None, fixed_in_release=None, fixed_in_rele
                 continue
             state = "needs-triage"
             if not pkg_in_rel(pkgname, release):
-                continue
+                # package doesn't exist in this release - we want to
+                # specify whether it exists but only for progenitor
+                # releases, not derived ones
+                if not cve_lib.release_progenitor(release):
+                    state = "DNE"
+                else:
+                    continue
             elif cve_lib.is_active_esm_release(r):
                 state = "ignored (out of standard support)"
             elif r == 'upstream' and fixed_in is not None:
@@ -242,7 +248,13 @@ def create_cve(cve, pkgname, fixed_in=None, fixed_in_release=None, fixed_in_rele
                 if (rel_pat.search(line)):
                     state = "needs-triage"
                     if not pkg_in_rel(pkgname, release):
-                        continue
+                        # package doesn't exist in this release - we want to
+                        # specify whether it exists but only for progenitor
+                        # releases, not derived ones
+                        if not cve_lib.release_progenitor(release):
+                            state = "DNE"
+                        else:
+                            continue
                     elif cve_lib.is_active_esm_release(release):
                         state = "ignored (out of standard support)"
                     elif release == 'upstream' and fixed_in is not None:
@@ -252,8 +264,9 @@ def create_cve(cve, pkgname, fixed_in=None, fixed_in_release=None, fixed_in_rele
                         higher_not_affected = True
                     elif higher_not_affected:
                         state = "not-affected"
-                    contents += "%s_%s: %s\n" % (release, pkgname, state)
-                    added.add(release)
+                    if release not in added:
+                        contents += "%s_%s: %s\n" % (release, pkgname, state)
+                        added.add(release)
         elif ref_pat.search(line):
             if not re.search(r'N', cve):
                 contents += line + "\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=" + cve + "\n"