Merge ~litios/ubuntu-cve-tracker:oval_pkgs_only_fixed into ubuntu-cve-tracker:master

[David Fernandez Gonzalez]

This PR adds an option to the Package OVAL generation for only listing fixed CVEs.

[Eduardo Barretto (ebarretto)]

overall lgtm!
but we could make the new argument help text a bit more specific that it only works with --pkg-oval, or maybe add the same feature to CVE-based OVAL.

review: Approve

[David Fernandez Gonzalez (litios)]

I agree, I'll add that before merging!

I was planning to standardize all options so we can apply them (if it makes sense) to all formats indistinguishably but for now, it's better if we say it only works with pkg format.

Thanks Eduardo!

diff --git a/scripts/generate-oval b/scripts/generate-oval
index 96d89cb..e7d13b7 100755
--- a/scripts/generate-oval
+++ b/scripts/generate-oval
@@ -110,6 +110,8 @@ def main():
     parser.add_argument('--packages', nargs='+', action='store', default=None,
                         help='generates oval for specific packages. Only for '
                         'CVE OVAL')
+    parser.add_argument('--fixed-only', action='store_true',
+                        help='only generate pkg oval for fixed CVEs')
 
     args = parser.parse_args()
     pathnames = args.pathname or default_cves_to_process
@@ -154,9 +156,9 @@ def main():
         releases = [args.oval_release] if args.oval_release else supported_releases
         for release in releases:
             if args.oci:
-                generate_oval_package(release, outdir, args.cve_prefix_dir, cache, cve_cache, args.oci, args.no_progress, args.packages, pathnames, ociprefix, ocioutdir)
+                generate_oval_package(release, outdir, args.cve_prefix_dir, cache, cve_cache, args.oci, args.no_progress, args.packages, pathnames, args.fixed_only, ociprefix, ocioutdir)
             else:
-                generate_oval_package(release, outdir, args.cve_prefix_dir, cache, cve_cache, args.oci, args.no_progress, args.packages, pathnames)
+                generate_oval_package(release, outdir, args.cve_prefix_dir, cache, cve_cache, args.oci, args.no_progress, args.packages, pathnames, args.fixed_only)
         return
 
     if args.oci:
@@ -579,10 +581,10 @@ def generate_oval_usn(outdir, usn, usn_release, cve_dir, usn_db_dir, ociprefix=N
 
     return True
 
-def generate_oval_package(release, outdir, cve_prefix_dir, pkg_cache, cve_cache, oci, no_progress, packages, pathnames, ociprefix=None, ocioutdir=None):
+def generate_oval_package(release, outdir, cve_prefix_dir, pkg_cache, cve_cache, oci, no_progress, packages, pathnames, fixed_only, ociprefix=None, ocioutdir=None):
     if not no_progress:
         print(f'[*] Generating OVAL for packages in release {release}')
-    ov = oval_lib.OvalGeneratorPkg(release, release_name(release), pathnames,packages, not no_progress,pkg_cache=pkg_cache, cve_cache=cve_cache, oval_format='oci' if oci else 'dpkg', outdir=outdir, cve_prefix_dir=cve_prefix_dir, prefix=ociprefix)
+    ov = oval_lib.OvalGeneratorPkg(release, release_name(release), pathnames, packages, not no_progress,pkg_cache=pkg_cache, fixed_only=fixed_only, cve_cache=cve_cache, oval_format='oci' if oci else 'dpkg', outdir=outdir, cve_prefix_dir=cve_prefix_dir, prefix=ociprefix)
     ov.generate_oval()
 
     if oci:
diff --git a/scripts/oval_lib.py b/scripts/oval_lib.py
index 6ec8136..fa16876 100644
--- a/scripts/oval_lib.py
+++ b/scripts/oval_lib.py
@@ -505,7 +505,7 @@ class Package:
         return self.__str__()
 
 class OvalGeneratorPkg(OvalGenerator):
-    def __init__(self, release, release_name, cve_paths, packages, progress, pkg_cache, cve_cache=None,  cve_prefix_dir=None, parent=None, warn_method=False, outdir='./', prefix='', oval_format='dpkg') -> None:
+    def __init__(self, release, release_name, cve_paths, packages, progress, pkg_cache, fixed_only=True, cve_cache=None,  cve_prefix_dir=None, parent=None, warn_method=False, outdir='./', prefix='', oval_format='dpkg') -> None:
         super().__init__(release, release_name, parent, warn_method, outdir, prefix, oval_format)
         ###
         # ID schema: 2204|00001|0001
@@ -521,6 +521,7 @@ class OvalGeneratorPkg(OvalGenerator):
         self.cve_cache = cve_cache
         self.pkg_cache = pkg_cache
         self.cve_paths = cve_paths
+        self.fixed_only = fixed_only
         self.packages = self._load_pkgs(cve_prefix_dir, packages)
 
     def _generate_advisory(self, package: Package) -> etree.Element:
@@ -529,7 +530,12 @@ class OvalGeneratorPkg(OvalGenerator):
         component = etree.SubElement(advisory, "component")
         version = etree.SubElement(advisory, "current_version")
 
+        pkg_id = Package.get_unique_id(package.name, self.release)
         for cve in package.cves:
+            if cve.pkg_rel_entries[pkg_id].status == 'not-vulnerable':
+                continue
+            elif self.fixed_only and cve.pkg_rel_entries[pkg_id].status != 'fixed':
+                continue
             cve_obj = self._generate_cve_object(cve)
             advisory.append(cve_obj)
 
@@ -1002,7 +1008,7 @@ class OvalGeneratorPkg(OvalGenerator):
 
         for cve in package.cves:
             pkg_rel_entry = cve.pkg_rel_entries[pkg_id]
-            if pkg_rel_entry.status == 'vulnerable':
+            if pkg_rel_entry.status == 'vulnerable' and not self.fixed_only:
                 cve_added = True
                 if one_time_added_id:
                     self._add_criterion(one_time_added_id, pkg_rel_entry, cve, definition_element)
@@ -1069,7 +1075,7 @@ class OvalGeneratorPkg(OvalGenerator):
 
         for cve in package.cves:
             pkg_rel_entry = cve.pkg_rel_entries[pkg_id]
-            if pkg_rel_entry.status == 'vulnerable':
+            if pkg_rel_entry.status == 'vulnerable' and not self.fixed_only:
                 cve_added = True
                 if one_time_added_id:
                     self._add_criterion(one_time_added_id, pkg_rel_entry, cve, definition_element, depth=3)