Merge ~ilasc/launchpad:add-vulnerability-orm into launchpad:master

[Ioana Lasc]

Add Vulnerability and VulnerabilityActivity

[Colin Watson (cjwatson)]

Be careful to ensure that non-nullable DB columns have `required=True` in their interface and `allow_none=False` in their model. I think I caught them all, but it might be helpful for you to do another pass after applying my suggestions.

Aside from that, most of my suggestions are relatively small, except for replacing `BugVulnerability` with `XRef` and my comments on an earlier thread about sorting out permissions on `Vulnerability`.

review: Approve

[Ioana Lasc (ilasc)]

Thanks Colin, this might be worth another look now that BugVulnerability was replaced with XRef.

[Colin Watson (cjwatson)]

review: Approve

diff --git a/lib/lp/bugs/configure.zcml b/lib/lp/bugs/configure.zcml
index 3064699..5a033b1 100644
--- a/lib/lp/bugs/configure.zcml
+++ b/lib/lp/bugs/configure.zcml
@@ -593,6 +593,51 @@
                 interface="lp.bugs.interfaces.cve.ICveSet"/>
         </securedutility>
 
+    <!-- Vulnerability -->
+    <class class="lp.bugs.model.vulnerability.Vulnerability">
+      <require
+        permission="launchpad.View"
+        interface="lp.bugs.interfaces.vulnerability.IVulnerabilityView
+                   lp.bugs.interfaces.vulnerability.IVulnerabilityEditableAttributes" />
+      <require
+        permission="launchpad.Edit"
+        interface="lp.bugs.interfaces.vulnerability.IVulnerabilityEdit"
+        set_schema="lp.bugs.interfaces.vulnerability.IVulnerabilityEditableAttributes" />
+
+      <!-- IBugLinkTarget -->
+      <allow
+          attributes="
+              bugs"/>
+      <require
+          permission="launchpad.Edit"
+          attributes="
+              linkBug
+              unlinkBug"/>
+    </class>
+    <class class="lp.bugs.model.vulnerability.VulnerabilitySet">
+      <allow interface="lp.bugs.interfaces.vulnerability.IVulnerabilitySet" />
+    </class>
+    <securedutility
+      class="lp.bugs.model.vulnerability.VulnerabilitySet"
+      provides="lp.bugs.interfaces.vulnerability.IVulnerabilitySet">
+      <allow interface="lp.bugs.interfaces.vulnerability.IVulnerabilitySet" />
+    </securedutility>
+
+    <!-- VulnerabilityActivity -->
+    <class class="lp.bugs.model.vulnerability.VulnerabilityActivity">
+      <require
+        permission="launchpad.View"
+        interface="lp.bugs.interfaces.vulnerability.IVulnerabilityActivity" />
+    </class>
+    <class class="lp.bugs.model.vulnerability.VulnerabilityActivitySet">
+      <allow interface="lp.bugs.interfaces.vulnerability.IVulnerabilityActivitySet" />
+    </class>
+    <securedutility
+      class="lp.bugs.model.vulnerability.VulnerabilityActivitySet"
+      provides="lp.bugs.interfaces.vulnerability.IVulnerabilityActivitySet">
+      <allow interface="lp.bugs.interfaces.vulnerability.IVulnerabilityActivitySet" />
+    </securedutility>
+
     <!-- BugSubscription -->
 
     <class
diff --git a/lib/lp/bugs/interfaces/vulnerability.py b/lib/lp/bugs/interfaces/vulnerability.py
 new file mode 100644
index 0000000..8fa01da
--- /dev/null
+++ b/lib/lp/bugs/interfaces/vulnerability.py
@@ -0,0 +1,255 @@
+# Copyright 2022 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+"""Vulnerability interfaces."""
+
+__all__ = [
+    'IVulnerability',
+    'IVulnerabilityActivity',
+    'IVulnerabilityActivitySet',
+    'IVulnerabilitySet',
+    'VulnerabilityChange',
+    'VulnerabilityStatus'
+    ]
+
+from lazr.enum import (
+    DBEnumeratedType,
+    DBItem,
+    )
+from lazr.restful.fields import Reference
+from zope.interface import Interface
+from zope.schema import (
+    Choice,
+    Datetime,
+    Int,
+    TextLine,
+    )
+
+from lp import _
+from lp.app.enums import InformationType
+from lp.app.interfaces.informationtype import IInformationType
+from lp.bugs.interfaces.bugtask import BugTaskImportance
+from lp.bugs.interfaces.cve import ICve
+from lp.registry.interfaces.distribution import IDistribution
+from lp.registry.interfaces.person import IPerson
+
+
+class VulnerabilityChange(DBEnumeratedType):
+    """Type of change in vulnerability
+
+    We use this enum to track changes occurring in
+    data stored in the vulnerability table.
+    """
+
+    STATUS = DBItem(0, """
+        Status
+
+        The status of the vulnerability changed.
+        """)
+
+    DESCRIPTION = DBItem(1, """
+        Description
+
+        The description of the vulnerability changed.
+        """)
+
+    NOTES = DBItem(2, """
+        Notes
+
+        The notes on the vulnerability changed.
+        """)
+
+    MITIGATION = DBItem(3, """
+        Mitigation
+
+        Mitigation for this vulnerability changed.
+        """)
+
+    IMPORTANCE = DBItem(4, """
+        Importance
+
+        The importance assigned for this vulnerability changed.
+        """)
+
+    IMPORTANCE_EXPLANATION = DBItem(5, """
+        Importance explanation
+
+        The importance explanation changed for this vulnerability.
+        """)
+
+    PRIVACY = DBItem(6, """
+        Privacy
+
+        The privacy for this vulnerability changed.
+        """)
+
+
+class VulnerabilityStatus(DBEnumeratedType):
+    """Vulnerability status"""
+
+    NEEDS_TRIAGE = DBItem(0, """
+        Needs triage
+
+        Not looked at yet.
+        """)
+
+    ACTIVE = DBItem(1, """
+        Active
+
+        The vulnerability is active.
+        """)
+
+    IGNORED = DBItem(2, """
+        Ignored
+
+        The vulnerability is currently ignored.
+        """)
+
+    RETIRED = DBItem(3, """
+        Retired
+
+        This vulnerability is now retired.
+        """)
+
+
+class IVulnerabilityView(Interface):
+    """`IVulnerability` attributes that require launchpad.View."""
+
+    id = Int(title=_("ID"), required=True, readonly=True)
+
+    distribution = Reference(IDistribution, title=_("Distribution"),
+                             required=True, readonly=True)
+
+    cve = Reference(ICve, title=_('External CVE reference corresponding'
+                                  ' to this vulnerability, if any.'),
+                    required=False, readonly=True)
+
+    date_created = Datetime(
+        title=_("The date this vulnerability was made public."),
+        required=True, readonly=True)
+
+    creator = Reference(
+        title=_('Person'), schema=IPerson, required=True, readonly=True)
+
+
+class IVulnerabilityEditableAttributes(Interface):
+    """`IVulnerability` attributes that can be edited.
+
+    These attributes need launchpad.View to see, and launchpad.Edit to change.
+    """
+
+    status = Choice(
+        title=_('Result of the report'),  readonly=True,
+        required=True, vocabulary=VulnerabilityStatus)
+
+    description = TextLine(
+        title=_("A short description of the vulnerability."), required=False,
+        readonly=False)
+
+    notes = TextLine(
+        title=_("Free-form notes for this vulnerability."), required=False,
+        readonly=False)
+
+    mitigation = TextLine(
+        title=_("Explains why we're ignoring a vulnerability."),
+        required=False, readonly=False)
+
+    importance = Choice(title=_('Importance used to indicate work priority,'
+                                ' not severity'),
+                        vocabulary=BugTaskImportance, required=True,
+                        default=BugTaskImportance.UNDECIDED, readonly=True)
+
+    importance_explanation = TextLine(
+        title=_("Used to explain why our importance differs "
+                "from somebody else's CVSS score."),
+        required=False, readonly=False)
+
+    information_type = Choice(
+        title=_("Information type"), vocabulary=InformationType,
+        required=True, readonly=False, default=InformationType.PUBLIC,
+        description=_(
+            "Indicates privacy of the vulnerability."))
+
+    date_made_public = Datetime(
+        title=_("The date this vulnerability was made public."),
+        required=False, readonly=False)
+
+
+class IVulnerabilityEdit(Interface):
+    """`IVulnerability` attributes that require launchpad.Edit."""
+
+
+class IVulnerability(IVulnerabilityView,
+                     IVulnerabilityEditableAttributes,
+                     IVulnerabilityEdit, IInformationType):
+    """Contract describing a vulnerability."""
+
+
+class IVulnerabilitySet(Interface):
+    """The set of all vulnerabilities."""
+
+    def new(distribution, status, importance,
+            creator, information_type=InformationType.PUBLIC, cve=None,
+            description=None, notes=None, mitigation=None,
+            importance_explanation=None, date_made_public=None):
+        """Return a new vulnerability.
+
+        :param distribution: The distribution for the vulnerability.
+        :param status: The status of the vulnerability.
+        :param importance: Indicates work priority, not severity.
+        :param creator: The user that created the vulnerability.
+        :param information_type: The privacy of the vulnerability.
+        :param cve: A `Cve` for which the vulnerability is being created.
+        :param description: The description of the vulnerability.
+        :param notes: The notes for the vulnerability.
+        :param mitigation: A short summary of the result.
+        :param importance_explanation: Used to explain why our importance
+         differs from somebody else's CVSS score.
+        :param date_made_public: The date this vulnerability was made public.
+        """
+
+
+class IVulnerabilityActivity(Interface):
+    """`IVulnerabilityActivity` attributes that require launchpad.View."""
+
+    id = Int(title=_("ID"), required=True, readonly=True)
+
+    vulnerability = Reference(IVulnerability, title=_('Vulnerability'),
+                              required=True, readonly=True)
+
+    date_changed = Datetime(
+        title=_("When activity last changed for this vulnerability."),
+        required=True, readonly=True)
+
+    changer = Reference(IPerson, title=_("Changer"), required=True,
+                        readonly=True,
+                        description=_("The person that made the changes."))
+
+    what_changed = Choice(
+        title=_('Indicates what field changed for the vulnerability.'),
+        readonly=True,
+        required=True, vocabulary=VulnerabilityChange)
+
+    old_value = TextLine(
+        title=_("Indicates the value prior to the change."), required=False,
+        readonly=True)
+
+    new_value = TextLine(
+        title=_("Indicates the current value."), required=False,
+        readonly=True)
+
+
+class IVulnerabilityActivitySet(Interface):
+    """The set of all activities for a certain vulnerability."""
+
+    def new(vulnerability, changer, what_changed=None,
+            old_value=None, new_value=None):
+        """Return a new vulnerability activity.
+
+        :param vulnerability: The vulnerability for this activity.
+        :param changer: The `Person` that performed the activity.
+        :param what_changed: The 'VulnerabilityChange' that occurred
+         for this vulnerability.
+        :param old_value: Indicates the value prior to the change.
+        :param new_value: Indicates the current value.
+        """
diff --git a/lib/lp/bugs/model/tests/test_vulnerability.py b/lib/lp/bugs/model/tests/test_vulnerability.py
 new file mode 100644
index 0000000..a9d7bc2
--- /dev/null
+++ b/lib/lp/bugs/model/tests/test_vulnerability.py
@@ -0,0 +1,121 @@
+# Copyright 2022 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+"""Tests for the vulnerability and related models."""
+from zope.component import getUtility
+
+from lp.bugs.interfaces.vulnerability import (
+    IVulnerabilitySet,
+    VulnerabilityChange,
+    )
+from lp.services.webapp.authorization import check_permission
+from lp.testing import (
+    admin_logged_in,
+    anonymous_logged_in,
+    person_logged_in,
+    TestCaseWithFactory,
+    verifyObject,
+    )
+from lp.testing.layers import DatabaseFunctionalLayer
+
+
+class TestVulnerability(TestCaseWithFactory):
+
+    layer = DatabaseFunctionalLayer
+
+    def setUp(self):
+        super().setUp()
+        self.distribution = self.factory.makeDistribution()
+        self.vulnerability = self.factory.makeVulnerability(
+            distribution=self.distribution)
+
+    def test_random_user(self):
+        with person_logged_in(self.factory.makePerson()):
+            self.assertTrue(
+                check_permission("launchpad.View", self.vulnerability))
+            self.assertFalse(
+                check_permission("launchpad.Edit", self.vulnerability))
+
+    def test_admin(self):
+        with admin_logged_in():
+            self.assertTrue(
+                check_permission("launchpad.View", self.vulnerability))
+            self.assertTrue(
+                check_permission("launchpad.Edit", self.vulnerability))
+
+    def test_non_admin(self):
+        with person_logged_in(self.distribution.owner):
+            self.assertTrue(
+                check_permission("launchpad.View", self.vulnerability))
+            self.assertTrue(
+                check_permission("launchpad.Edit", self.vulnerability))
+
+    def test_anonymous(self):
+        with anonymous_logged_in():
+            self.assertFalse(
+                check_permission("launchpad.View", self.vulnerability))
+            self.assertFalse(
+                check_permission("launchpad.Edit", self.vulnerability))
+
+
+class TestVulnerabilityActivity(TestCaseWithFactory):
+
+    layer = DatabaseFunctionalLayer
+
+    def test_vulnerability_activity_changes(self):
+        vulnerability = self.factory.makeVulnerability()
+        changer = self.factory.makePerson()
+        activity = self.factory.makeVulnerabilityActivity(
+            vulnerability=vulnerability, changer=None)
+        with person_logged_in(changer):
+            self.assertTrue(VulnerabilityChange.DESCRIPTION,
+                            activity.what_changed)
+
+
+class TestVulnerabilitySet(TestCaseWithFactory):
+
+    layer = DatabaseFunctionalLayer
+
+    def test_VulnerabilitySet_implements_IVulnerabilitySet(self):
+        vulnerabilitySet = getUtility(IVulnerabilitySet)
+        self.assertTrue(verifyObject(IVulnerabilitySet, vulnerabilitySet))
+
+    def test_bugVulnerabilityCount(self):
+        # vulnerability3 linked bugs will not be reflected
+        # in computations of linked bugs on
+        # vulnerability 1 and 2
+
+        vulnerability1 = self.factory.makeVulnerability()
+        vulnerability2 = self.factory.makeVulnerability()
+        vulnerability3 = self.factory.makeVulnerability()
+        bug1 = self.factory.makeBug()
+        bug2 = self.factory.makeBug()
+        initial_number = len(vulnerability1.bugs)
+        with admin_logged_in():
+            vulnerability1.linkBug(bug1)
+            vulnerability3.linkBug(bug1)
+            vulnerability3.linkBug(bug2)
+
+        self.assertEqual(
+            initial_number + 1,
+            len(vulnerability1.bugs))
+
+        with admin_logged_in():
+            vulnerability2.linkBug(bug2)
+        self.assertEqual(
+            initial_number + 2,
+            (len(vulnerability1.bugs) + len(vulnerability2.bugs)))
+
+        with admin_logged_in():
+            vulnerability2.linkBug(bug1)
+        self.assertEqual(
+            initial_number + 3,
+            (len(vulnerability1.bugs) + len(vulnerability2.bugs)))
+
+        with admin_logged_in():
+            vulnerability1.unlinkBug(bug1)
+            vulnerability2.unlinkBug(bug2)
+            vulnerability2.unlinkBug(bug1)
+        self.assertEqual(
+            initial_number,
+            (len(vulnerability1.bugs) + len(vulnerability2.bugs)))
diff --git a/lib/lp/bugs/model/vulnerability.py b/lib/lp/bugs/model/vulnerability.py
 new file mode 100644
index 0000000..77ebcb3
--- /dev/null
+++ b/lib/lp/bugs/model/vulnerability.py
@@ -0,0 +1,191 @@
+# Copyright 2022 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+__all__ = [
+    'Vulnerability',
+    'VulnerabilitySet',
+    ]
+
+import operator
+
+import pytz
+from storm.locals import (
+    DateTime,
+    Int,
+    Reference,
+    Unicode,
+    )
+from zope.component import getUtility
+from zope.interface import implementer
+
+from lp.app.enums import InformationType
+from lp.bugs.interfaces.buglink import IBugLinkTarget
+from lp.bugs.interfaces.bugtask import BugTaskImportance
+from lp.bugs.interfaces.vulnerability import (
+    IVulnerability,
+    IVulnerabilityActivity,
+    IVulnerabilityActivitySet,
+    IVulnerabilitySet,
+    VulnerabilityChange,
+    VulnerabilityStatus,
+    )
+from lp.bugs.model.bug import Bug
+from lp.bugs.model.buglinktarget import BugLinkTargetMixin
+from lp.services.database import bulk
+from lp.services.database.constants import UTC_NOW
+from lp.services.database.enumcol import DBEnum
+from lp.services.database.interfaces import IStore
+from lp.services.database.stormbase import StormBase
+from lp.services.xref.interfaces import IXRefSet
+
+
+@implementer(IVulnerability, IBugLinkTarget)
+class Vulnerability(StormBase, BugLinkTargetMixin):
+    __storm_table__ = 'Vulnerability'
+
+    id = Int(primary=True)
+
+    distribution_id = Int(name="distribution", allow_none=False)
+    distribution = Reference(distribution_id, "Distribution.id")
+
+    cve_id = Int(name="cve", allow_none=True, default=None)
+    cve = Reference(cve_id, "Cve.id")
+
+    status = DBEnum(name='status', allow_none=False,
+                    enum=VulnerabilityStatus)
+
+    description = Unicode(name='description', allow_none=True)
+
+    notes = Unicode(name='notes', allow_none=True)
+
+    mitigation = Unicode(name='mitigation', allow_none=True)
+
+    importance = DBEnum(
+        name='importance', allow_none=False,
+        enum=BugTaskImportance,
+        default=BugTaskImportance.UNDECIDED)
+
+    importance_explanation = Unicode(
+        name='importance_explanation', allow_none=True)
+
+    information_type = DBEnum(
+        enum=InformationType, default=InformationType.PUBLIC,
+        allow_none=False, name="information_type")
+
+    date_created = DateTime(
+        name='date_created', tzinfo=pytz.UTC, allow_none=False,
+        default=UTC_NOW)
+
+    date_made_public = DateTime(
+        name='date_made_public', tzinfo=pytz.UTC, allow_none=True)
+
+    creator_id = Int(name='creator', allow_none=False)
+    creator = Reference(creator_id, 'Person.id')
+
+    def __init__(self, distribution, status, importance,
+                 creator, information_type=InformationType.PUBLIC, cve=None,
+                 description=None, notes=None, mitigation=None,
+                 importance_explanation=None, date_made_public=None):
+        super().__init__()
+        self.distribution = distribution
+        self.cve = cve
+        self.status = status
+        self.importance = importance
+        self.information_type = information_type
+        self.creator = creator
+        self.description = description
+        self.notes = notes
+        self.mitigation = mitigation
+        self.importance_explanation = importance_explanation
+        self.date_made_public = date_made_public
+        self.date_created = UTC_NOW
+
+    @property
+    def bugs(self):
+        bug_ids = [
+            int(id) for _, id in getUtility(IXRefSet).findFrom(
+                ('vulnerability', str(self.id)), types=['bug'])]
+        return list(sorted(
+            bulk.load(Bug, bug_ids), key=operator.attrgetter('id')))
+
+    def createBugLink(self, bug, props=None):
+        """See BugLinkTargetMixin."""
+        if props is None:
+            props = {}
+        getUtility(IXRefSet).create(
+            {('vulnerability', str(self.id)): {('bug', str(bug.id)): props}})
+
+    def deleteBugLink(self, bug):
+        """See BugLinkTargetMixin."""
+        getUtility(IXRefSet).delete(
+            {('vulnerability', str(self.id)): [('bug', str(bug.id))]})
+
+
+@implementer(IVulnerabilitySet)
+class VulnerabilitySet:
+
+    def new(self, distribution, status, importance,
+            creator, information_type=InformationType.PUBLIC, cve=None,
+            description=None, notes=None, mitigation=None,
+            importance_explanation=None, date_made_public=None):
+        """See `IVulnerabilitySet`."""
+        store = IStore(Vulnerability)
+        vulnerability = Vulnerability(distribution=distribution,
+                                      creator=creator, cve=cve,
+                                      status=status, description=description,
+                                      notes=notes, mitigation=mitigation,
+                                      importance=importance,
+                                      information_type=information_type,
+                                      importance_explanation=
+                                      importance_explanation,
+                                      date_made_public=date_made_public)
+        store.add(vulnerability)
+        return vulnerability
+
+
+@implementer(IVulnerabilityActivity)
+class VulnerabilityActivity(StormBase):
+    __storm_table__ = 'VulnerabilityActivity'
+
+    id = Int(primary=True)
+
+    vulnerability_id = Int(name="vulnerability", allow_none=False)
+    vulnerability = Reference(vulnerability_id, "Vulnerability.id")
+
+    changer_id = Int(name="changer", allow_none=False)
+    changer = Reference(changer_id, "Person.id")
+
+    date_changed = DateTime(
+        name='date_changed', tzinfo=pytz.UTC, allow_none=False)
+
+    what_changed = DBEnum(name='what_changed', allow_none=False,
+                          enum=VulnerabilityChange)
+
+    old_value = Unicode(name='old_value', allow_none=True)
+
+    new_value = Unicode(name='new_value', allow_none=True)
+
+    def __init__(self, vulnerability, changer, what_changed=None,
+                 old_value=None, new_value=None):
+        super().__init__()
+        self.vulnerability = vulnerability
+        self.changer = changer
+        self.what_changed = what_changed
+        self.old_value = old_value
+        self.new_value = new_value
+        self.date_changed = UTC_NOW
+
+
+@implementer(IVulnerabilityActivitySet)
+class VulnerabilityActivitySet:
+
+    def new(self, vulnerability, changer,
+            what_changed,
+            old_value=None, new_value=None):
+        """See `IVulnerabilityActivitySet`."""
+        store = IStore(VulnerabilityActivity)
+        activity = VulnerabilityActivity(vulnerability, changer,
+                                         what_changed,
+                                         old_value, new_value)
+        store.add(activity)
+        return activity
diff --git a/lib/lp/security.py b/lib/lp/security.py
index fbada1b..037f0d8 100644
--- a/lib/lp/security.py
+++ b/lib/lp/security.py
@@ -55,6 +55,7 @@ from lp.blueprints.model.specificationsubscription import (
     )
 from lp.bugs.interfaces.bugtarget import IOfficialBugTagTargetRestricted
 from lp.bugs.interfaces.structuralsubscription import IStructuralSubscription
+from lp.bugs.interfaces.vulnerability import IVulnerability
 from lp.bugs.model.bugsubscription import BugSubscription
 from lp.bugs.model.bugtaskflat import BugTaskFlat
 from lp.bugs.model.bugtasksearch import get_bug_privacy_filter
@@ -3797,3 +3798,14 @@ class EditCIBuild(AdminByBuilddAdmin):
         if auth_repository.checkAuthenticated(user):
             return True
         return super().checkAuthenticated(user)
+
+
+class EditVulnerability(AuthorizationBase):
+    permission = 'launchpad.Edit'
+    usedfor = IVulnerability
+
+    def checkAuthenticated(self, user):
+        return (user.in_commercial_admin or user.in_admin or
+                user.isOwner(self.obj.distribution) or
+                user.isDriver(self.obj.distribution) or
+                user.isBugSupervisor(self.obj.distribution))
diff --git a/lib/lp/testing/factory.py b/lib/lp/testing/factory.py
index 7c79147..1bbdfe1 100644
--- a/lib/lp/testing/factory.py
+++ b/lib/lp/testing/factory.py
@@ -83,6 +83,7 @@ from lp.bugs.interfaces.bug import (
     IBugSet,
     )
 from lp.bugs.interfaces.bugtask import (
+    BugTaskImportance,
     BugTaskStatus,
     IBugTaskSet,
     )
@@ -95,6 +96,12 @@ from lp.bugs.interfaces.cve import (
     CveStatus,
     ICveSet,
     )
+from lp.bugs.interfaces.vulnerability import (
+    IVulnerabilityActivitySet,
+    IVulnerabilitySet,
+    VulnerabilityChange,
+    VulnerabilityStatus,
+    )
 from lp.bugs.model.bug import FileBugData
 from lp.buildmaster.enums import (
     BuildBaseImageType,
@@ -5378,6 +5385,53 @@ class BareLaunchpadObjectFactory(ObjectFactory):
         IStore(build).flush()
         return build
 
+    def makeVulnerability(self, distribution=None, status=None,
+                          importance=None, creator=None,
+                          information_type=InformationType.PUBLIC, cve=None,
+                          description=None, notes=None, mitigation=None,
+                          importance_explanation=None, date_made_public=None):
+        """Make a new `Vulnerability`."""
+        if distribution is None:
+            distribution = self.makeDistribution()
+        if status is None:
+            status = VulnerabilityStatus.NEEDS_TRIAGE
+        if importance is None:
+            importance = BugTaskImportance.UNDECIDED
+        if creator is None:
+            creator = self.makePerson()
+        if importance_explanation is None:
+            importance_explanation = self.getUniqueString(
+                "vulnerability-importance-explanation")
+        return getUtility(
+            IVulnerabilitySet).new(
+            distribution=distribution, cve=cve, status=status,
+            importance=importance, creator=creator,
+            information_type=information_type, description=description,
+            notes=notes, mitigation=mitigation,
+            importance_explanation=importance_explanation,
+            date_made_public=date_made_public)
+
+    def makeVulnerabilityActivity(self, vulnerability=None, changer=None,
+                                  what_changed=None, old_value=None,
+                                  new_value=None):
+        """Make a new `VulnerabilityActivity`."""
+        if vulnerability is None:
+            vulnerability = self.makeVulnerability()
+        if changer is None:
+            changer = self.makePerson()
+        if what_changed is None:
+            what_changed = VulnerabilityChange.DESCRIPTION
+        if old_value is None:
+            old_value = self.getUniqueString("old-value")
+        if new_value is None:
+            new_value = self.getUniqueString("new-value")
+        return getUtility(
+            IVulnerabilityActivitySet).new(vulnerability=vulnerability,
+                                           changer=changer,
+                                           what_changed=what_changed,
+                                           old_value=old_value,
+                                           new_value=new_value)
+
 
 # Some factory methods return simple Python types. We don't add
 # security wrappers for them, as well as for objects created by