Merge ~litios/ubuntu-cve-tracker:tags-patches-publishing-cve into ubuntu-cve-tracker:master

[David Fernandez Gonzalez]

Right now, when publishing a CVE, we are generating entries for patches and tags for packages in subprojects.

That doesn't show on the web page but it does in the USNs: https://ubuntu.com/security/notices/USN-5686-2.json

We should only generate entries for the patches and tags present in the original CVE.

Thanks Cami for both finding the issue on the webpage and in the code!

Testing: https://pastebin.canonical.com/p/7Vhz9Sq72Z/

[Camila Camargo de Matos (ccdm94)]

I am by no means a cve_lib expert, but after some explanation from @litios, and some testing using the sample code provided, this LGTM.

The tags change might seem like the correct way to go about this, since with the change, if there are no tags, the field will be empty, as expected if there are no tags (when I say "expected", I mean, in theory). I am just not sure if this would break anything that uses the tags information and expects to receive a non-empty dictionary, even if the non-empty dictionary only contains keys with empty lists, so that might be worth checking out.

After initial analysis, it seems like from our side nothing would break, as we have the following:
  - for the 'tags' key being accessed in `html_export.py`: we have the `if pkg in data['tags']:` instruction, so there is a check here before accessing the tag information. The loop just won't execute in this case (at all), and what is executed inside the loop does not look like something that will affect the rest of the code negatively.
  - for the 'tags' key being accessed in `cve_lib`: the access seems to occur on top of data recovered directly from a CVE file through `load_cves`, so I guess the webpage data being different wouldn't cause any issues in the execution of functions from `cve_lib`, since the webpage that is not what is being used as a reference.

[Eduardo Barretto (ebarretto)]

lgtm, thanks both for finding the issue and fixing it quickly

review: Approve

[Paulo Flabiano Smorigo (pfsmorigo)]

LGTM Thanks!

review: Approve

[Camila Camargo de Matos (ccdm94)]

review: Approve

diff --git a/scripts/publish-cves-to-website-api.py b/scripts/publish-cves-to-website-api.py
index f27db84..1342eac 100755
--- a/scripts/publish-cves-to-website-api.py
+++ b/scripts/publish-cves-to-website-api.py
@@ -41,11 +41,11 @@ def get_codename(raw_codename, cve_releases):
 
     return get_devel_codename(cve_releases)
 
-def get_tags(cve_data, pkg):
-    return list(cve_data['tags'].get(pkg, list()))
-
-def get_patches(cve_data, pkg):
-    return [ patch_type + ": " + entry for patch_type, entry in cve_data['patches'].get(pkg, list())]
+def get_patches(cve_data):
+    patches = {}
+    for pkg in cve_data['patches']:
+        patches[pkg] = [patch_type + ": " + entry for patch_type, entry in cve_data['patches'].get(pkg)]
+    return patches
 
 def get_devel_codename(cve_releases):
     for skip_release in ['upstream', 'devel', 'product', 'snap']:
@@ -97,14 +97,12 @@ def post_single_cve(cve_filename):
                 impact = None
 
     packages = []
-    tags = {}
-    patches = {}
+    tags = cve_data['tags']
+    patches = get_patches(cve_data)
     for pkg in cve_data["pkgs"]:
         statuses = []
         cve_releases = cve_data["pkgs"][pkg].keys()
         cve_releases = [rel for rel in cve_releases if rel in cve_lib.releases]
-        tags[pkg] = get_tags(cve_data, pkg)
-        patches[pkg] = get_patches(cve_data, pkg)
 
         for codename in cve_lib.releases + ["upstream"]:
             status = None