Merge ~eslerm/ubuntu-cve-tracker:check-cves-f-strings into ubuntu-cve-tracker:master

[Mark Esler]

check-cves: switch formatting regular strings to f-strings and friends

Converts formatting of regular strings to f-strings.

> F-strings provide a concise, readable way to include the value of Python expressions inside strings.
https://peps.python.org/pep-0498/

f-strings were introduced in 3.6. This means that f-strings work on bionic++.

There are four remaining cases involving regex that I did not want to change and test in this MR.

There are several cases where `print("%s" % foo)` is replaced as `print(foo)`.

And a case where concatenating strings was clearer. e.g., `str_a + str_b`

Note that f-strings cannot contain backslashes, hence cases like `print(" %s" % "\n ".join(info))` are kept.

This is my second time linting check-cves to use f-strings. I reviewed my code several times for errors after my final commit and ran several use cases.

[Marc Deslauriers (mdeslaur)]

These changes LGTM. Thanks for breaking down all your refactoring into reviewable changes!

review: Approve

[Steve Beattie (sbeattie)]

 review approve

On Fri, Mar 15, 2024 at 10:52:17PM -0000, Mark Esler wrote:
> @@ -1344,20 +1351,20 @@ class CVEHandler(xml.sax.handler.ContentHandler):
> if dpkg_compare_versions(version, 'ge', fixed_version):
> if rel == cve_lib.devel_release:
> rel = 'devel'
> - fixed_in += ",%s,%s" % (rel, version)
> + fixed_in += f",{rel},{version}"
> break
> elif self.debian[cve]['pkgs'][pkg]['state'].startswith('<not-affected>') and \
> len(self.debian[cve]['pkgs'][pkg]['priority']) > 0:
> # capture that debian believes their version is unaffected
> - not_affected.append((pkg, "debian: %s" % self.debian[cve]['pkgs'][pkg]['priority']))
> - cmd += ['-p', "%s%s" % (pkg, fixed_in)]
> + not_affected.append(pkg, f"debian: {self.debian[cve]['pkgs'][pkg]['priority']}")

Note that the append() call here gets converted from a tuple to two
arguments, which append() won't accept. I added a commit to reinstate
the tuple:

 https://git.launchpad.net/ubuntu-cve-tracker/commit/?id=946c26c48f8619120efe31c73581823d082dbb42

and have merged your changes with it to master.

Thanks!

--
Steve Beattie
<email address hidden>

review: Approve

[Marc Deslauriers (mdeslaur)]

Oh, nice catch, I didn't notice that one.

[Mark Esler (eslerm)]

Thank you for the thorough review and merge!

diff --git a/scripts/check-cves b/scripts/check-cves
index 0ce30ef..c00cd27 100755
--- a/scripts/check-cves
+++ b/scripts/check-cves
@@ -254,7 +254,7 @@ def import_debian(handler):
         for cve in dsas[dsa]['cves']:
             if not cve_lib.CVE_RE.match(cve):
                 if args.verbose:
-                    print("Skipping %s, not well-formed?" % cve, file=sys.stderr)
+                    print(f"Skipping {cve}, not well-formed?", file=sys.stderr)
                 continue
 
             year = int(re.split('-', cve)[1])
@@ -275,27 +275,27 @@ def import_debian(handler):
             cves[cve]['date'] = dsas[dsa]['date']
 
             if args.verbose:
-                print("Processing %s: %s (%s)" % (dsa, dsas[dsa]['desc'], cves[cve]['date']), file=sys.stderr)
+                print(f"Processing {dsa}: {dsas[dsa]['desc']} ({cves[cve]['date']})", file=sys.stderr)
 
     # Now pull in CVEs from the data/CVE/list
     for cve in handler.debian:
         if args.verbose:
-            print("[--- Processing %s ---]" % cve, file=sys.stderr)
+            print(f"[--- Processing {cve} ---]", file=sys.stderr)
 
         if cve in cves:
             if args.verbose:
-                print("Skipping %s, already found in DSA" % cve, file=sys.stderr)
+                print(f"Skipping {cve}, already found in DSA", file=sys.stderr)
             continue
 
         if not cve_lib.CVE_RE.match(cve):
             if args.verbose:
-                print("Skipping %s, not well-formed?" % cve, file=sys.stderr)
+                print(f"Skipping {cve}, not well-formed?", file=sys.stderr)
             continue
 
         year = int(re.split('-', cve)[1])
         if year < cve_limit:
             if args.verbose:
-                print("Skipping %s, year %d predates %d" % (cve, year, cve_limit), file=sys.stderr)
+                print(f"Skipping {cve}, year {year} predates {cve_limit}", file=sys.stderr)
             continue
 
         # If we already know about the CVE, skip it unless is mistriaged
@@ -305,7 +305,7 @@ def import_debian(handler):
                 handler.debian[cve]['desc'] = mistriaged_hint + handler.debian[cve]['desc']
             else:
                 if args.verbose:
-                    print("Skipping %s, already known" % cve, file=sys.stderr)
+                    print(f"Skipping {cve}, already known", file=sys.stderr)
                 continue
 
         if handler.debian[cve]['desc'] or handler.debian[cve]['state'] == 'FOUND':
@@ -315,13 +315,13 @@ def import_debian(handler):
                 cves[cve]['subject'] = '[Unknown description]'
 
             # just make something up. It'll get adjusted whenever mitre adds it
-            date = "%s-12-31" % year
+            date = f"{year}-12-31"
             if year >= today.year:
-                date = "%s-%s-%s" % (today.year, today.month, today.day)
+                date =  f"{today.year}-{today.month}-{today.day}"
             cves[cve]['date'] = datetime.strptime(date, "%Y-%m-%d")
 
             if args.verbose:
-                print("Processing %s: %s (%s)" % (cve, handler.debian[cve]['desc'], cves[cve]['date']), file=sys.stderr)
+                print(f"Processing {cve}: {handler.debian[cve]['desc']} ({cves[cve]['date']})", file=sys.stderr)
 
     nvd = convert_to_nvd(cves, lambda cve: cves[cve]['subject'])
     tmp = tempfile.NamedTemporaryFile(mode='w', prefix='debian-import_', suffix='.json', delete=False)
@@ -397,12 +397,12 @@ def read_rhel8oval_file(f):
        file for processing.
     '''
     if not os.path.isfile(f):
-        print("'%s' not a file" % f, file=sys.stderr)
+        print(f"'{f}' not a file", file=sys.stderr)
         sys.exit(1)
 
     name = os.path.abspath(f + ".json")
     if os.path.exists(name):
-        print("'%s' already exists" % name, file=sys.stderr)
+        print(f"'{name}' already exists", file=sys.stderr)
         sys.exit(1)
 
     parser = xml.sax.make_parser()
@@ -425,12 +425,12 @@ def read_locate_cves_output(f):
        file for processing.
     '''
     if not os.path.isfile(f):
-        print("'%s' not a file" % f, file=sys.stderr)
+        print(f"'{f}' not a file", file=sys.stderr)
         sys.exit(1)
 
     name = os.path.abspath(f + ".json")
     if os.path.exists(name):
-        print("'%s' already exists" % name, file=sys.stderr)
+        print(f"'{name}' already exists", file=sys.stderr)
         sys.exit(1)
 
     with open(f) as _f:
@@ -449,15 +449,15 @@ def read_locate_cves_output(f):
         if line.startswith("Couldn't find CVE"):
             cve = line.split()[2]
             if not cve_lib.CVE_RE.match(cve):
-                print("Skipping malformed CVE: '%s' from '%s'" % (cve, f), file=sys.stderr)
+                print(f"Skipping malformed CVE: '{cve}' from '{f}'", file=sys.stderr)
                 cve = None
             elif cve in cves:
                 if args.verbose:
-                    print("Skipping duplicate '%s' from '%s'" % (cve, f), file=sys.stderr)
+                    print(f"Skipping duplicate '{cve}' from '{f}'", file=sys.stderr)
                 cve = None
             else:
                 if args.verbose:
-                    print("Adding '%s'" % cve, file=sys.stderr)
+                    print(f"Adding '{cve}'", file=sys.stderr)
                 cves[cve] = dict()
             continue
 
@@ -469,7 +469,7 @@ def read_locate_cves_output(f):
                 date = " ".join(line.split(": ")[1].strip().split()[0:5])
                 cves[cve]['date'] = datetime.strptime(date, "%a, %d %b %Y %H:%M:%S")
             except Exception:
-                print("Could not process date '%s', skipping %s from '%s'" % (line, cve, f), file=sys.stderr)
+                print(f"Could not process date '{line}', skipping {cve} from '{f}'", file=sys.stderr)
                 del cves[cve]
                 cve = None
                 continue
@@ -491,11 +491,10 @@ def read_locate_cves_output(f):
             # NOTE: while we can determine the url for the year/month/day, we
             # cannot determine the specific message on that day. This gets us
             # close though, so use it.
-            url = "http://www.openwall.com/lists/oss-security/%s" % (cves[cve]['date'].strftime("%Y/%m/%d"))
+            url = "http://www.openwall.com/lists/oss-security/" + cves[cve]['date'].strftime('%Y/%m/%d')
             cves[cve].setdefault('refs', [] + [url])
 
-    nvd = convert_to_nvd(cves, lambda c: '''ML-Date: %s, ML-Subject: %s''' %
-                         (cves[c]['date'], escape(cves[c]['subject'])))
+    nvd = convert_to_nvd(cves, lambda c: f'''ML-Date: {cves[c]['date']}, ML-Subject: {escape(cves[c]['subject'])}''')
 
     tmp = tempfile.NamedTemporaryFile(mode='w', prefix='locate-cves-import_', suffix='.json', delete=False)
     tmp.file.write(json.dumps(nvd))
@@ -510,7 +509,7 @@ def read_mbox_file(f):
        And process through read_locate_cves_output()
     '''
     if not os.path.isfile(f) and not os.path.isdir(f):
-        print("'%s' not a file" % f, file=sys.stderr)
+        print(f"'{f}' not a file", file=sys.stderr)
         sys.exit(1)
 
     child = subprocess.Popen(['./scripts/locate_cves.py', f], stdout=subprocess.PIPE, universal_newlines=True)
@@ -602,17 +601,23 @@ class CVEHandler(xml.sax.handler.ContentHandler):
         timestamp = time.strftime("%Y-%m-%d %H:%M:%S", time.gmtime())
 
         # Append to timestamp file list
-        with open('%s/check-cves.log' % (destdir), 'a') as f:
-            f.write('%s UTC - %s added, %s ignored, %s skipped, %s total - files: %s\n' %
-                (timestamp, self.num_added, self.num_ignored, self.num_skipped, self.num_added + self.num_ignored, [os.path.basename(x) for x in args.uris]))
+        with open(f'{destdir}/check-cves.log', 'a') as f:
+            f.write(
+                f"{timestamp} UTC - "
+                f"{self.num_added} added, "
+                f"{self.num_ignored} ignored, "
+                f"{self.num_skipped} skipped, "
+                f"{self.num_added + self.num_ignored} total - "
+                f"files: {[os.path.basename(x) for x in args.uris]}\n"
+            )
 
     def printReport(self):
         print('\n============================ Triage summary =============================')
-        print("\n %4d CVEs added" % self.num_added)
-        print(" %4d CVEs ignored" % self.num_ignored)
-        print(" %4d CVEs skipped" % self.num_skipped)
+        print(f"\n {self.num_added: 4d} CVEs added")
+        print(f" {self.num_ignored: 4d} CVEs ignored")
+        print(f" {self.num_skipped: 4d} CVEs skipped")
         print("---------------------------")
-        print("%5d total CVEs triaged" % (self.num_added + self.num_ignored))
+        print(f"{self.num_added + self.num_ignored: 5d} total CVEs triaged")
         updates_detected, updates_details = self.detect_updates_to_external_repositories()
         if updates_detected:
             print('\n====================== External updates detected ========================')
@@ -636,7 +641,7 @@ class CVEHandler(xml.sax.handler.ContentHandler):
                 if process.returncode == 0 and process.stdout:
                     if process.stdout:
                         updates_detected = True
-                        updates_details += "\n %s \n %s" % (repository_dir, process.stdout)
+                        updates_details += f"\n {repository_dir} \n {process.stdout}"
             except subprocess.CalledProcessError as exception:
                 print(exception)
                 updates_detected = False
@@ -657,11 +662,11 @@ class CVEHandler(xml.sax.handler.ContentHandler):
                             "data_version": "4.0"}
             for key in list(template_cve.keys()):
                 if key not in cve or cve[key] != template_cve[key]:
-                    raise KeyError("NVD JSON in '%s' seems invalid" % fp.name)
+                    raise KeyError(f"NVD JSON in '{fp.name}' seems invalid")
 
             metadata = cve["CVE_data_meta"]
             if not re.match(r'^CVE-\d{4}-\d{4,}$', metadata["ID"]):
-                print("Ignoring invalid CVE with ID '%s'" % metadata["ID"])
+                print(f"Ignoring invalid CVE with ID '{metadata['ID']}'")
                 return
             self.curr_cve = metadata["ID"]
 
@@ -693,7 +698,7 @@ class CVEHandler(xml.sax.handler.ContentHandler):
             # check for expected fields
             for key in list(template_nvd.keys()):
                 if key not in record or record[key] != template_nvd[key]:
-                    raise KeyError("NVD JSON in '%s' seems invalid - missing key '%s'" % (fp.name, key))
+                    raise KeyError(f"NVD JSON in '{fp.name}' seems invalid - missing key '{key}'")
             for item in record["CVE_Items"]:
                 self.curr_cvss = []
                 self.curr_refs = []
@@ -787,7 +792,7 @@ class CVEHandler(xml.sax.handler.ContentHandler):
             return
 
         if self.curr_cve in self.cve_seen:
-            print("Skipping repeat: %s" % (self.curr_cve), file=sys.stderr)
+            print(f"Skipping repeat: {self.curr_cve}", file=sys.stderr)
             return
         self.cve_seen.add(self.curr_cve)
 
@@ -802,18 +807,20 @@ class CVEHandler(xml.sax.handler.ContentHandler):
         return self.cve_list
 
     def display_command_file_usage(self, f, line_prefix=''):
-        f.write('%sThe following commands can be used in this file:\n' % (line_prefix))
-        f.write('%s\n' % (line_prefix))
-        f.write('%s* Add a new CVE to the tracker:\n' % (line_prefix))
-        f.write('%s  <CVE> add <PRIORITY> <PACKAGE> [PACKAGE] ...\n' % (line_prefix))
-        f.write('%s* Add a new CVE to the tracker and open it in your editor:\n' % (line_prefix))
-        f.write('%s  <CVE> edit <PRIORITY> <PACKAGE> [PACKAGE] ...\n' % (line_prefix))
-        f.write('%s* Unembargo a CVE that is now public:\n' % (line_prefix))
-        f.write('%s  <CVE> unembargo>\n' % (line_prefix))
-        f.write('%s* Permanently ignore a CVE:\n' % (line_prefix))
-        f.write('%s  <CVE> ignore <REASON>\n' % (line_prefix))
-        f.write('%s* Temporarily skip over a CVE:\n' % (line_prefix))
-        f.write('%s  <CVE> skip\n\n' % (line_prefix))
+        # fmt: off
+        f.write(f'{line_prefix}The following commands can be used in this file:\n')
+        f.write(f'{line_prefix}\n')
+        f.write(f'{line_prefix}* Add a new CVE to the tracker:\n')
+        f.write(f'{line_prefix}  <CVE> add <PRIORITY> <PACKAGE> [PACKAGE] ...\n')
+        f.write(f'{line_prefix}* Add a new CVE to the tracker and open it in your editor:\n')
+        f.write(f'{line_prefix}  <CVE> edit <PRIORITY> <PACKAGE> [PACKAGE] ...\n')
+        f.write(f'{line_prefix}* Unembargo a CVE that is now public:\n')
+        f.write(f'{line_prefix}  <CVE> unembargo>\n')
+        f.write(f'{line_prefix}* Permanently ignore a CVE:\n')
+        f.write(f'{line_prefix}  <CVE> ignore <REASON>\n')
+        f.write(f'{line_prefix}* Temporarily skip over a CVE:\n')
+        f.write(f'{line_prefix}  <CVE> skip\n\n')
+        # fmt: on
         f.flush()
 
     def find_hint_in_external_subprojects(self, software_hints_from_cve_description):
@@ -861,24 +868,24 @@ class CVEHandler(xml.sax.handler.ContentHandler):
             print('=================================end details==================================')
         # Display CVE information
         if self.cve_data[cve]['public']:
-            print(' Published: %s' % (self.cve_data[cve]['public']))
+            print(f" Published: {self.cve_data[cve]['public']}")
         for ref in self.cve_data[cve]['refs']:
-            print(' %s: %s' % (ref[0], ref[1]), end='')
+            print(f' {ref[0]}: {ref[1]}', end='')
             # Do not repeat URL if it matches the contents of the reference
             if ref[2] and ref[1].strip() != ref[2].strip():
-                print(' %s' % (ref[2]), end='')
+                print(f' {ref[2]}', end='')
             print()
         if wrap_desc:
-            print('%s' % _wrap_desc(self.cve_data[cve]['desc']))
+            print(_wrap_desc(self.cve_data[cve]['desc']))
         else:
             print('\n======================== CVE details ==========================')
-            print(' %s' % cve)
-            print(' %s' % (self.cve_data[cve]['desc']))
+            print(f' {cve}')
+            print(f" {self.cve_data[cve]['desc']}")
         for cvss in self.cve_data[cve]['cvss']:
-            print(' CVSS (%s): %s [%.1f]' % (cvss['source'], cvss['vector'], cvss['baseScore']))
+            print(f" CVSS ({cvss['source']}): {cvss['vector']} [{cvss['baseScore']: .1f}]")
         if self.debian and cve in self.debian:
             print('\n======================= Debian details ========================')
-            print(' Debian CVE Tracker: %s' % (self.debian[cve]['state']))
+            print(f" Debian CVE Tracker: {self.debian[cve]['state']}")
             if len(self.debian[cve]['note']):
                 print("\t" + "\n\t".join(self.debian[cve]['note']))
             for pkg in self.debian[cve]['pkgs']:
@@ -889,23 +896,23 @@ class CVEHandler(xml.sax.handler.ContentHandler):
                     info.append(self.debian[cve]['pkgs'][pkg]['bug'])
                 if self.debian[cve]['pkgs'][pkg]['note']:
                     info.append(self.debian[cve]['pkgs'][pkg]['note'])
-                print("  Debian: %s: %s (%s)" % (pkg, self.debian[cve]['pkgs'][pkg]['state'], "; ".join(info)))
+                print(f"  Debian: {pkg}: {self.debian[cve]['pkgs'][pkg]['state']} ({'; '.join(info)})")
                 # Display version and component details for Ubuntu's pkg
                 answer = source_map.madison(source, pkg)
                 for name in sorted(answer.keys()):
                     for pkg in sorted(answer[name].keys()):
-                        print('    Ubuntu: %s | %s | %s' % (pkg, answer[name][pkg], name))
+                        print(f'    Ubuntu: {pkg} | {answer[name][pkg]} | {name}')
             # no debian info, display possible commented ignore command when
             # using command file (i.e. wrap_desc is true)
             if (self.debian[cve]['state'] == 'RESERVED' or self.debian[cve]['state'] == None)  and wrap_desc:
                 proposed_ignore = self.ignore_suggestion.get_ignore_suggestion(self.cve_data[cve]['desc'])
-                print('%s ignore "%s"' % (cve, proposed_ignore))
+                print(f'{cve} ignore "{proposed_ignore}"')
             # debian rejected, so offer to reject by ignoring when using command file (i.e. wrap_desc is true)
             if (self.debian[cve]['state'] == 'REJECTED' and wrap_desc):
-                print('%s ignore "%s"' % (cve, "REJECTED"))
+                print(f'{cve} ignore "REJECTED"')
         else:
             proposed_ignore = self.ignore_suggestion.get_ignore_suggestion(self.cve_data[cve]['desc'])
-            print('%s ignore %s' % (cve, proposed_ignore))
+            print(f'{cve} ignore {proposed_ignore}')
 
         software_hints_from_cve_desc = self.get_software_hints_from_cve_description(self.cve_data[cve]["desc"])
         if software_hints_from_cve_desc:
@@ -953,7 +960,7 @@ class CVEHandler(xml.sax.handler.ContentHandler):
                         if self.debian[cve]['pkgs'][pkg]['state'] == '<itp>':
                             # software has not been admitted into debian
                             action = 'ignore'
-                            reason = '%s: <itp> (dbug %s)' % (pkg, self.debian[cve]['pkgs'][pkg]['bug'])
+                            reason = f"{pkg}: <itp> (dbug {self.debian[cve]['pkgs'][pkg]['bug']})"
                 if self.debian[cve]['state'] == 'REJECTED':
                     action = 'ignore'
                     reason = 'REJECTED'
@@ -1003,7 +1010,7 @@ class CVEHandler(xml.sax.handler.ContentHandler):
     def human_process_cve(self, cve, action='skip', reason='', package=''):
         info = ''
         while info == "" or not info[0] in ['i', 'a', 's', 'q', 'r']:
-            prompt_user('\nA]dd (or R]epeat), I]gnore forever, S]kip for now, or Q]uit? [%s] ' % (action))
+            prompt_user(f'\nA]dd (or R]epeat), I]gnore forever, S]kip for now, or Q]uit? [{action}] ')
             info = sys.stdin.readline().strip().lower()
             if info == "":
                 info = action
@@ -1023,7 +1030,7 @@ class CVEHandler(xml.sax.handler.ContentHandler):
                     if package == "":
                         package = self.saved_package
                     if package != "":
-                        prompt_user('[%s] ' % (package))
+                        prompt_user(f'[{package}] ')
                     info = sys.stdin.readline().strip()
                     if info == '':
                         info = package
@@ -1037,19 +1044,19 @@ class CVEHandler(xml.sax.handler.ContentHandler):
             self.saved_cve = cve
 
             print('\n===================== Dependant packages ======================')
-            print(' Detecting packages built using: %s...' % info, end='')
+            print(f' Detecting packages built using: {info}...', end='')
             sys.stdout.flush()
             built_using = ""
             try:
                 built_using = get_built_using(info)
             except Exception as e:
-                print("ERROR: %s" % e, file=sys.stderr)
+                print(f"ERROR: {e}", file=sys.stderr)
                 pass  # for now just show the error but don't break triage
 
             if built_using != "":
                 print("found:\n")
-                print("%s" % source_map.get_built_using_header())
-                print("%s" % built_using)
+                print(source_map.get_built_using_header())
+                print(built_using)
                 print("IMPORTANT: the above packages are candidates for rebuilds when fixes are applied to:")
                 print(" %s" % "\n ".join(info))
             else:
@@ -1071,7 +1078,7 @@ class CVEHandler(xml.sax.handler.ContentHandler):
                         prompts.append(choice)
 
                 for i in range(0, len(prompts)):
-                    print('   %s) %s' % (chr(97 + i), prompts[i]))
+                    print(f"   {chr(97 + i)}) {prompts[i]}")
                 prompt_user(' > ')
 
                 info = sys.stdin.readline().strip()
@@ -1113,13 +1120,13 @@ class CVEHandler(xml.sax.handler.ContentHandler):
             try:
                 (cve, action) = (args[0].upper(), args[1].lower())
             except IndexError:
-                raise ValueError('Invalid formatting on line %d:\n%s' % (line_num, orig_line))
+                raise ValueError(f'Invalid formatting on line {line_num}:\n{orig_line}')
 
             if not cve.startswith('CVE-'):
                 # The first arg should look like a CVE ID
-                raise ValueError('Invalid CVE ID formatting (%s) on line %d:\n%s' % (cve, line_num, orig_line))
+                raise ValueError(f'Invalid CVE ID formatting ({cve}) on line {line_num}:\n{orig_line}')
             elif cve in cves:
-                    raise ValueError('Performing multiple operations on the same CVE (%s) is not supported (line %d):\n%s' % (cve, line_num, orig_line))
+                    raise ValueError(f'Performing multiple operations on the same CVE ({cve}) is not supported (line {line_num}):\n{orig_line}')
             cves.append(cve)
 
             if action == 'add' or action == 'edit':
@@ -1130,13 +1137,13 @@ class CVEHandler(xml.sax.handler.ContentHandler):
                     priority = args[0].lower()
                     packages = args[1:]
                 except IndexError:
-                    raise ValueError('Invalid add command on line %d:\n%s' % (line_num, orig_line))
+                    raise ValueError(f'Invalid add command on line {line_num}:\n{orig_line}')
 
                 if not priority in cve_lib.priorities and not priority == 'untriaged':
-                    raise ValueError('Invalid priority on line %d:\n%s' % (line_num, orig_line))
+                    raise ValueError(f'Invalid priority on line {line_num}:\n{orig_line}')
 
-                if os.path.exists('%s/active/%s' % (destdir, cve)):
-                    raise ValueError('Updating an existing CVE is not supported (line %d):\n%s' % (line_num, orig_line))
+                if os.path.exists(f'{destdir}/active/{cve}'):
+                    raise ValueError(f'Updating an existing CVE is not supported (line {line_num}):\n{orig_line}')
 
                 if preprocess:
                     continue
@@ -1150,10 +1157,10 @@ class CVEHandler(xml.sax.handler.ContentHandler):
                     _spawn_editor(cve_path)
             elif action == 'unembargo':
                 if cve not in EmbargoList:
-                    raise ValueError('CVE %s is not in the embargo database (line %d):\n%s' % (cve, line_num, orig_line))
+                    raise ValueError(f'CVE {cve} is not in the embargo database (line {line_num}):\n{orig_line}')
 
                 if os.path.exists(os.path.join('active', cve)):
-                    raise ValueError('Cannot unembargo %s because it already exists in the active directory (line %d):\n%s' % (cve, line_num, orig_line))
+                    raise ValueError(f'Cannot unembargo {cve} because it already exists in the active directory (line {line_num}):\n{orig_line}')
 
                 if preprocess:
                     continue
@@ -1164,7 +1171,7 @@ class CVEHandler(xml.sax.handler.ContentHandler):
                 try:
                     reason = args[2]
                 except IndexError:
-                    raise ValueError('Invalid ignore command on line %d:\n%s' % (line_num, orig_line))
+                    raise ValueError(f'Invalid ignore command on line {line_num}:\n{orig_line}')
 
                 if preprocess:
                     continue
@@ -1173,7 +1180,7 @@ class CVEHandler(xml.sax.handler.ContentHandler):
             elif action == 'skip':
                 # If the CVE should be skipped, no arguments are allowed
                 if len(args) > 2:
-                    raise ValueError('Invalid skip command on line %d:\n%s' % (line_num, orig_line))
+                    raise ValueError(f'Invalid skip command on line {line_num}:\n{orig_line}')
 
                 if preprocess:
                     continue
@@ -1181,7 +1188,7 @@ class CVEHandler(xml.sax.handler.ContentHandler):
                 self.skip_cve()
             else:
                 # The second arg must be a known action
-                raise ValueError('Unknown action (%s) on line %d:\n%s' % (action, line_num, orig_line))
+                raise ValueError(f'Unknown action ({action}) on line {line_num}:\n{orig_line}')
 
     def preprocess_cve(self, cve):
         desc = ''
@@ -1195,20 +1202,20 @@ class CVEHandler(xml.sax.handler.ContentHandler):
             desc += '# =================================end details==================================\n'
         # Display CVE information
         if self.cve_data[cve]['public']:
-            desc += '#  Published: %s\n' % (self.cve_data[cve]['public'])
+            desc += f'#  Published: {self.cve_data[cve]["public"]}\n'
         for ref in self.cve_data[cve]['refs']:
-            desc += '#  %s: %s' % (ref[0], ref[1])
+            desc += f'#  {ref[0]}: {ref[1]}'
             # Do not repeat URL if it matches the contents of the reference
             if ref[2] and ref[1].strip() != ref[2].strip():
-                desc += ' %s' % (ref[2])
+                desc += f' {ref[2]}'
             desc += '\n'
         for line in _wrap_desc(self.cve_data[cve]['desc']).split('\n'):
-            desc += '#  %s\n' % line
+            desc += f'#  {line}\n'
         if self.debian and cve in self.debian:
-            desc += '# Debian CVE Tracker: %s\n' % (self.debian[cve]['state'])
+            desc += f"# Debian CVE Tracker: {self.debian[cve]['state']}\n"
             if len(self.debian[cve]['note']):
                 for note in self.debian[cve]['note']:
-                    desc += '# \t%s\n' % note
+                    desc += f'# \t{note}\n'
             for pkg in self.debian[cve]['pkgs']:
                 info = []
                 if self.debian[cve]['pkgs'][pkg]['priority']:
@@ -1222,7 +1229,7 @@ class CVEHandler(xml.sax.handler.ContentHandler):
                 answer = source_map.madison(source, pkg)
                 for name in sorted(answer.keys()):
                     for pkg in sorted(answer[name].keys()):
-                        desc += '#     Ubuntu: %s | %s | %s\n' % (pkg, answer[name][pkg], name)
+                        desc += f'#     Ubuntu: {pkg} | {answer[name][pkg]} | {name}\n'
 
         action = 'skip'
         data = ""
@@ -1240,13 +1247,13 @@ class CVEHandler(xml.sax.handler.ContentHandler):
                 action = 'add'
                 data = " ".join(self.debian[cve]['pkgs'])
 
-        print('%s %s %s\n%s' % (action, cve, data, desc))
+        print(f'{action} {cve} {data}\n{desc}')
 
     def add_cve(self, cve, packages, priority=None):
         # remove from not-for-us.txt if adding and ensure we remove any
         # mistriaged_hint from the description
         if cve in CVEIgnoreNotForUsSet:
-            cmd = ['sed', '-i', '/^%s #.*$/d' % cve, './ignored/not-for-us.txt']
+            cmd = ['sed', '-i', f'/^{cve} #.*$/d', './ignored/not-for-us.txt']
             subprocess.call(cmd)
             self.cve_data[cve]['desc'] = self.cve_data[cve]['desc'].replace(mistriaged_hint, '')
 
@@ -1294,7 +1301,7 @@ class CVEHandler(xml.sax.handler.ContentHandler):
                 elif self.debian[cve]['pkgs'][pkg]['bug']:
                     bug = self.debian[cve]['pkgs'][pkg]['bug']
                 if bug:
-                    url = "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=%s" % bug
+                    url = "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=" + bug
                     if url not in bug_urls:
                         bug_urls.append(url)
 
@@ -1330,7 +1337,7 @@ class CVEHandler(xml.sax.handler.ContentHandler):
                self.debian[cve]['pkgs'][pkg]['state']:
                 if re.search(r'^[0-9]', self.debian[cve]['pkgs'][pkg]['state']):
                     fixed_version = self.debian[cve]['pkgs'][pkg]['state']
-                    fixed_in = ",%s" % fixed_version
+                    fixed_in = f",{fixed_version}"
 
                     # Now see if we can correlate this to an Ubuntu version
                     answer = source_map.madison(source, pkg)
@@ -1344,20 +1351,20 @@ class CVEHandler(xml.sax.handler.ContentHandler):
                             if dpkg_compare_versions(version, 'ge', fixed_version):
                                 if rel == cve_lib.devel_release:
                                     rel = 'devel'
-                                fixed_in += ",%s,%s" % (rel, version)
+                                fixed_in += f",{rel},{version}"
                                 break
                 elif self.debian[cve]['pkgs'][pkg]['state'].startswith('<not-affected>') and \
                         len(self.debian[cve]['pkgs'][pkg]['priority']) > 0:
                     # capture that debian believes their version is unaffected
-                    not_affected.append((pkg, "debian: %s" % self.debian[cve]['pkgs'][pkg]['priority']))
-            cmd += ['-p', "%s%s" % (pkg, fixed_in)]
+                    not_affected.append(pkg, f"debian: {self.debian[cve]['pkgs'][pkg]['priority']}")
+            cmd += ['-p', f"{pkg}{fixed_in}"]
 
         subprocess.call(cmd)
         for (pkg, reason) in not_affected:
             cmd = ['./scripts/mass-cve-edit', '-p', pkg, '-r', 'upstream', '-s', 'not-affected', '-v', reason, cve]
             subprocess.call(cmd)
         self.num_added += 1
-        return './active/%s' % cve
+        return f'./active/{cve}'
 
     def unembargo_cve(self, cve):
         # unembargo a cve now public
@@ -1368,8 +1375,8 @@ class CVEHandler(xml.sax.handler.ContentHandler):
         # Append to ignore list unless is already in CVEIgnoreList and then
         # append to the ignored/ignore-mistriaged.txt
         txtfile = 'ignore-mistriaged.txt' if cve in CVEIgnoreNotForUsSet else 'not-for-us.txt'
-        with open('%s/ignored/%s' % (destdir, txtfile), 'a') as f:
-            f.write('%s # %s\n' % (cve, reason))
+        with open(f'{destdir}/ignored/{txtfile}', 'a') as f:
+            f.write(f'{cve} # {reason}\n')
 
         self.num_ignored += 1
 
@@ -1428,7 +1435,7 @@ if args.cve:
             continue
         # error out if is ignored
         if cve in CVEIgnoreList:
-            print("%s already exists in UCT - please remove it then retriage." % cve)
+            print(f"{cve} already exists in UCT - please remove it then retriage.")
             sys.exit(1)
         specific_cves.add(cve)
 
@@ -1453,7 +1460,7 @@ if (args.import_missing_debian or args.mistriaged) and handler.debian is not Non
 
 
 for uri in args.uris:
-    print('Loading %s ...' % (uri), file=sys.stderr)
+    print(f'Loading {uri} ...', file=sys.stderr)
     if '://' in uri:
         readable = urllib.request.urlopen(uri)
     else:
@@ -1464,7 +1471,7 @@ for uri in args.uris:
         else:
             parser.parse(readable)
     except xml.sax._exceptions.SAXParseException as e:
-        print("\n\nWARNING: %s is malformed:\n%s" % (uri, e))
+        print(f"\n\nWARNING: {uri} is malformed:\n{e}")
         print("Aborting", file=sys.stderr)
         sys.exit(1)
     print('')
@@ -1490,17 +1497,17 @@ def refresh_cves(cve_refresh_list, full_refresh=True):
             cvsss = handler.cve_data[cve]['cvss']
         except:
             if args.verbose:
-                print('%s not listed in XML' % (cve), file=sys.stderr)
+                print(f'{cve} not listed in XML', file=sys.stderr)
 
         # Find the on-disk CVE file
         cvefile = ""
         for status in ['active', 'retired', 'ignored']:
-            check = '%s/%s/%s' % (destdir, status, cve)
+            check = f'{destdir}/{status}/{cve}'
             if os.path.exists(check):
                 cvefile = check
                 break
         if cvefile == "":
-            print('local dirs missing %s?!' % (cve), file=sys.stderr)
+            print(f'local dirs missing {cve}?!', file=sys.stderr)
             continue
 
         # Load CVE
@@ -1524,14 +1531,14 @@ def refresh_cves(cve_refresh_list, full_refresh=True):
                 if data['Description'].strip() != desc:
                     cve_lib.update_multiline_field(cvefile, 'Description', desc)
                     updated = True
-                    debug("updated description for %s" % (cvefile))
+                    debug(f"updated description for {cvefile}")
 
             # Update Publication Date if it needs it
             if public:
                 if 'PublicDate' not in data or ('PublicDate' in data and data['PublicDate'] != public):
                     cve_lib.update_field(cvefile, 'PublicDate', public)
                     updated = True
-                    debug("updated pubdate for %s" % (cvefile))
+                    debug(f"updated pubdate for {cvefile}")
 
             # Add CVE Reference, if it's missing
             if 'References' in data and re.match(r'^CVE-\d+-\d+$', cve):
@@ -1539,19 +1546,19 @@ def refresh_cves(cve_refresh_list, full_refresh=True):
                 if mitre_ref not in data['References']:
                     cve_lib.add_reference(cvefile, mitre_ref)
                     updated = True
-                    debug("updated reference for %s" % (cvefile))
+                    debug(f"updated reference for {cvefile}")
 
         # Update CVSS if needs it
         for entry in cvsss:
             try:
                 updated |= cve_lib.add_cvss(cvefile, entry['source'], entry['vector'])
-                debug("updated cvss for %s" % (cvefile))
+                debug(f"updated cvss for {cvefile}")
             except KeyError:
                 # we might not have a vector, in this case continue
                 pass
 
         if updated:
-            print("Refreshed %s" % (cvefile), file=sys.stderr)
+            print(f"Refreshed {cvefile}", file=sys.stderr)
 
 
 if args.refresh or args.score_refresh:
@@ -1608,8 +1615,8 @@ for cve in new_cves:
 
     if not experimental:
         print('\n***********************************************************************')
-        print(' %s    (%d/%d: %d%%)' % (cve, count, total, (count * 100 / total)))
-        print(' https://cve.mitre.org/cgi-bin/cvename.cgi?name=%s' % (cve))
+        print(f" {cve}    ({count}/{total}: {int(count * 100 / total)}%)")
+        print(f" https://cve.mitre.org/cgi-bin/cvename.cgi?name={cve}")
         print('***********************************************************************')
         handler.display_cve(cve, file=fout)
         (action, reason, packages) = handler.get_cve_suggestions(cve)
@@ -1619,16 +1626,16 @@ for cve in new_cves:
     else:
         line_prefix = '# '
 
-        fout.write('%s%s\n#\n' % (line_prefix, cve))
+        fout.write('{line_prefix}{cve}\n#\n')
         handler.display_cve(cve, file=fout, line_prefix=line_prefix, wrap_desc=True)
 
         (action, reason, packages) = handler.get_cve_suggestions(cve)
-        suggestion = '%s %s' % (cve, action)
+        suggestion = f'{cve} {action}'
         if reason:
-            suggestion += ' %s' % (reason)
+            suggestion += f' {reason}'
         elif action == 'add':
-            suggestion += ' untriaged %s' % (packages)
-        fout.write('%s\n\n' % (suggestion))
+            suggestion += f' untriaged {packages}'
+        fout.write(f'{suggestion}\n\n')
 
 if experimental:
     fout.flush()
@@ -1636,7 +1643,7 @@ if experimental:
         assert((total == 0 and count == 0) or (total > 0 and count >= 0))
         # no need to spawn editor if no CVEs listed
         if count > 0:
-            prompt_user('Asking user to handle %d CVEs...' % count)
+            prompt_user(f'Asking user to handle {count} CVEs...')
             _spawn_editor(fout.name)
         else:
             prompt_user('Not spawning editor as no CVEs to process')
@@ -1645,8 +1652,7 @@ if experimental:
             handler.process_command_file(fout, preprocess=True)
             break
         except Exception as e:
-            print('Error encountered while processing the command file!', file=sys.stderr)
-            print('%s' % e, file=sys.stderr)
+            print(f'Error encountered while processing the command file!\n{e}', file=sys.stderr)
             print('Enter "quit" to lose all work or anything else to re-edit and try again: ', end='', file=sys.stderr)
             sys.stderr.flush()
             response = sys.stdin.readline().strip().lower()