Code review comment for ~eslerm/ubuntu-cve-tracker:website-fix-tag

Assuming I understand you correctly, I think if you move it to cve_lib you'll end up having to fix up all existing users of Patches within cve_lib to then expect a list of tuples, not a list of strings which feels like too much churn - particularly if you want to restructure the CVE files eventually anyway to make this more hierarchical as per your example earlier - so I think we merge this as is then can work on improving things later.