Merge ~litios/ubuntu-cve-tracker:oval-refactor into ubuntu-cve-tracker:master

[David Fernandez Gonzalez]

This PR refactors the OVAL generation. The main changes are:

* Use of XML library.
* Creation of a common Generator class that shares most of the code needed to generate the OVAL elements.
* Refactor of CVE Generator and PKG generator to inherit from this class.
* Refactor of generate-oval to share a common interface
* New feature for pkg cache when the pkg version is not present: now it will use the lowest in the release if the binary versions differ.

The biggest impact will be on OVAL CVE, as the IDs, spacing, etc will differ now due to using the same one as PKG OVAL has been using.

[Eduardo Barretto (ebarretto)]

Hey, I just did a quick check and found some small things to improve and wanted to mention already.
I will continue to check the code later and run some tests locally too.
Thanks for all this hard work :)

review: Needs Fixing

7365bc8... by David Fernandez Gonzalez on 2023-11-03

oval: increase generator speed

Signed-off-by: David Fernandez Gonzalez <email address hidden>

0574f1a... by David Fernandez Gonzalez on 2023-11-03

generate-oval: improvements

Signed-off-by: David Fernandez Gonzalez <email address hidden>

107e5ce... by David Fernandez Gonzalez on 2023-11-15

oval_lib: use CVE-based IDs for definitions for CVE OVAL

Signed-off-by: David Fernandez Gonzalez <email address hidden>

bec0e63... by David Fernandez Gonzalez on 2023-11-16

oval_lib: fix some bugs

Signed-off-by: David Fernandez Gonzalez <email address hidden>

29ca294... by David Fernandez Gonzalez on 2023-11-16

oval_lib: replace macos tag by linux

Signed-off-by: David Fernandez Gonzalez <email address hidden>

7239e32... by David Fernandez Gonzalez on 2023-11-16

oval_lib: bump OVAL generator version to 2

Signed-off-by: David Fernandez Gonzalez <email address hidden>

a42624b... by David Fernandez Gonzalez on 2023-11-16

oval_lib: use latest version binaries when vulnerable

e0a6581... by David Fernandez Gonzalez on 2023-11-16

oval_lib: PKG - fix ids and ignore packages without binaries

Signed-off-by: David Fernandez Gonzalez <email address hidden>

7595fed... by David Fernandez Gonzalez on 2023-11-20

OVAL: fix test to fit new linux tag

Signed-off-by: David Fernandez Gonzalez <email address hidden>

9bf1b0f... by David Fernandez Gonzalez on 2023-11-23

OVAL: CVE - use same IDs as old format

Signed-off-by: David Fernandez Gonzalez <email address hidden>

42bf4f9... by David Fernandez Gonzalez on 2023-11-28

OVAL: CVE/PKG no longer use tmp directories

Signed-off-by: David Fernandez Gonzalez <email address hidden>

08b5354... by David Fernandez Gonzalez on 2023-11-28

OVAL: prefix argument is not longer used for CVE/PKG

Signed-off-by: David Fernandez Gonzalez <email address hidden>

05c7540... by David Fernandez Gonzalez on 2023-11-28

OVAL: enable ocioutdir for PKG/CVE

Signed-off-by: David Fernandez Gonzalez <email address hidden>

[Eduardo Barretto (ebarretto)]

lgtm!
thanks for landing the last fixes!

review: Approve

89047d3... by David Fernandez Gonzalez on 2023-11-30

OVAL: improve USN generation code

 * Fix bug when not listing releases
 * Refactor generate_oval_usn code in generate-oval

Signed-off-by: David Fernandez Gonzalez <email address hidden>

3acb478... by David Fernandez Gonzalez on 2023-11-30

OVAL: make IDs smaller

Signed-off-by: David Fernandez Gonzalez <email address hidden>

[David Fernandez Gonzalez (litios)]

Thanks a lot for all the reviews and the patience to check everything!!

diff --git a/scripts/generate-oval b/scripts/generate-oval
index 723127f..bdb9902 100755
--- a/scripts/generate-oval
+++ b/scripts/generate-oval
@@ -96,8 +96,8 @@ def main():
                         '(default is ./)')
     parser.add_argument('--usn-number', default=None, type=str,
                         help='if passed specifics a USN for the oval_usn generator')
-    parser.add_argument('--oval-release', default=None, type=str,
-                        help='specifies a release to generate the oval usn')
+    parser.add_argument('--oval-releases', default=None, action='append',
+                        help='specifies releases to generate the oval')
     parser.add_argument('--packages', nargs='+', action='store', default=None,
                         help='generates oval for specific packages. Only for '
                         'CVE OVAL')
@@ -132,27 +132,23 @@ def main():
 
     if args.usn_oval:
         if args.oci:
-            generate_oval_usn(args.output_dir, args.usn_number, args.oval_release,
-                              args.cve_prefix_dir, args.usn_db_dir, ociprefix, ocioutdir)
+            generate_oval_usn(args.output_dir, args.usn_number, args.oval_releases,
+                              args.cve_prefix_dir, args.usn_db_dir, args.no_progress, ociprefix, ocioutdir)
         else:
-            generate_oval_usn(args.output_dir, args.usn_number, args.oval_release,
-                              args.cve_prefix_dir, args.usn_db_dir)
+            generate_oval_usn(args.output_dir, args.usn_number, args.oval_releases,
+                              args.cve_prefix_dir, args.usn_db_dir, args.no_progress,)
 
         return
 
     # if --oval-release, we still need to load parents cache
     # so we can generate a complete oval for those releases that
     # have a parent
-    if args.oval_release:
-        releases = [args.oval_release]
-        if args.oval_release not in supported_releases:
-            error(f"unknown oval release {args.oval_release}")
-        else:
-            r = args.oval_release
-            while release_parent(r):
-                r = release_parent(r)
-                releases.append(r)
-        supported_releases = releases
+    releases = supported_releases
+    if args.oval_releases:
+        releases = args.oval_releases
+        for release in releases:
+            if release not in supported_releases:
+                error(f"unknown oval release {release}")
 
     cache = {}
     for release in supported_releases:
@@ -161,17 +157,15 @@ def main():
 
     if args.pkg_oval:
         if args.oci:
-            generate_oval_package(outdir, args.cve_prefix_dir, cache, cve_cache, args.oci, args.no_progress, args.packages, pathnames, args.fixed_only, ociprefix, ocioutdir)
+            generate_oval_package(releases, outdir, args.cve_prefix_dir, cache, cve_cache, args.oci, args.no_progress, args.packages, pathnames, args.fixed_only, ocioutdir)
         else:
-            generate_oval_package(outdir, args.cve_prefix_dir, cache, cve_cache, args.oci, args.no_progress, args.packages, pathnames, args.fixed_only)
+            generate_oval_package(releases, outdir, args.cve_prefix_dir, cache, cve_cache, args.oci, args.no_progress, args.packages, pathnames, args.fixed_only)
         return
 
     if args.oci:
-        generate_oval_cve(outdir, args.cve_prefix_dir, cache, args.oci,
-                          args.no_progress, args.packages, pathnames,  ociprefix, ocioutdir)
+        generate_oval_cve(releases, outdir, args.cve_prefix_dir, cache, cve_cache, args.oci, args.no_progress, args.packages, pathnames, args.fixed_only, ocioutdir)
     else:
-        generate_oval_cve(outdir, args.cve_prefix_dir, cache, args.oci,
-                          args.no_progress, args.packages, pathnames)
+        generate_oval_cve(releases, outdir, args.cve_prefix_dir, cache, cve_cache, args.oci, args.no_progress, args.packages, pathnames, args.fixed_only)
     return
 
 
@@ -390,7 +384,7 @@ def get_usn_database(usn_db_dir):
 # WARNING:
 #  be sure the release you are passing is in the usn-number passed
 #  otherwise it will generate an oval file without the usn info.
-def generate_oval_usn(outdir, usn, usn_release, cve_dir, usn_db_dir, ociprefix=None, ocioutdir=None):
+def generate_oval_usn(outdir, usn, usn_releases, cve_dir, usn_db_dir, no_progress, ociprefix=None, ocioutdir=None):
     # Get the usn database.json data
     usn_database = get_usn_database(usn_db_dir)
     if not usn_database:
@@ -400,33 +394,28 @@ def generate_oval_usn(outdir, usn, usn_release, cve_dir, usn_db_dir, ociprefix=N
         if usn not in usn_database:
             error("Please enter a valid USN number or update your database.json and try again")
 
-    if usn_release:
-        if usn_release not in supported_releases:
-            error("Please enter a valid release name.")
-
     # Create OvalGeneratorUSN objects
     ovals = []
-    # Does the oval for just a specific given release
-    if usn_release:
-        ovals.append(oval_lib.OvalGeneratorUSN(usn_release, release_name(usn_release), outdir, cve_dir))
-        # Also produce oval generator object for OCI
-        if ocioutdir:
-            ovals.append(oval_lib.OvalGeneratorUSN(usn_release, release_name(usn_release), ocioutdir,
-                                                   cve_dir, ociprefix, 'oci'))
+    valid_releases = []
+
+    # Check or generate valid releases
+    if usn_releases:
+        for usn_release in usn_releases:
+            if usn_release not in supported_releases:
+                error(f"Invalid release name '{usn_release}'.")
+        valid_releases = usn_releases
     else:
-        for release in supported_releases:
-            # for now we don't differentiate products (e.g. esm) in the USN DB
-            product, series = product_series(release)
-            if product != PRODUCT_UBUNTU:
-                continue
+        valid_releases = list(filter(lambda release: product_series(release)[0] == PRODUCT_UBUNTU, supported_releases))
 
-            ovals.append(oval_lib.OvalGeneratorUSN(release, release_name(release), outdir, cve_dir))
-            # Also produce oval generator object for OCI
-            if ocioutdir:
-                ovals.append(oval_lib.OvalGeneratorUSN(release, release_name(release), ocioutdir,
-                                                       cve_dir, ociprefix,
-                                                       'oci'))
+    if not no_progress:
+        print('[*] Generating OVAL USN for packages in releases', ', '.join(valid_releases))
 
+    for release in valid_releases:
+        ovals.append(oval_lib.OvalGeneratorUSN(release, release_name(release), outdir, cve_dir))
+        # Also produce oval generator object for OCI
+        if ocioutdir:
+            ovals.append(oval_lib.OvalGeneratorUSN(release, release_name(release), ocioutdir,
+                                                cve_dir, ociprefix, 'oci'))
     # Generate OVAL USN data
     if usn:
         prepend_usn_to_id(usn_database, usn)
@@ -441,62 +430,62 @@ def generate_oval_usn(outdir, usn, usn_release, cve_dir, usn_db_dir, ociprefix=N
     for oval in ovals:
         oval.write_oval_elements()
 
+    if not no_progress:
+        print(f'[*] Done generating OVAL USN for packages in releases {", ".join(valid_releases)}')
+
     return True
 
-def generate_oval_package(outdir, cve_prefix_dir, pkg_cache, cve_cache, oci, no_progress, packages, pathnames, fixed_only, ociprefix='', ocioutdir=None):
-    for release in supported_releases:
-        if not no_progress:
-            print(f'[*] Generating OVAL for packages in release {release}')
-        ov = oval_lib.OvalGeneratorPkg(release, release_name(release), pathnames, packages, not no_progress, pkg_cache=pkg_cache, fixed_only=fixed_only, cve_cache=cve_cache, oval_format='oci' if oci else 'dpkg', outdir=outdir, cve_prefix_dir=cve_prefix_dir, prefix=ociprefix)
+def generate_oval_package(releases, outdir, cve_prefix_dir, pkg_cache, cve_cache, oci, no_progress, packages, pathnames, fixed_only, ocioutdir=None):
+    if not no_progress:
+        print(f'[*] Generating OVAL PKG for packages in releases {", ".join(releases)}')
+
+    ov = oval_lib.OvalGeneratorPkg(
+        releases, 
+        pathnames, 
+        packages, 
+        not no_progress, 
+        pkg_cache=pkg_cache, 
+        fixed_only=fixed_only, 
+        cve_cache=cve_cache, 
+        oval_format='dpkg',
+        outdir=outdir, 
+        cve_prefix_dir=cve_prefix_dir
+    )
+    ov.generate_oval()
+
+    if oci:
+        ov.oval_format = 'oci'
+        ov.output_dir = ocioutdir
         ov.generate_oval()
 
-        if oci:
-            ov.oval_format = 'dpkg'
-            ov.generate_oval()
-
-        if not no_progress:
-            print(f'[X] Done generating OVAL for packages in release {release}')
-
-def generate_oval_cve(outdir, cve_prefix_dir, cache, oci, no_progress, packages, pathnames, ociprefix=None, ocioutdir=None):
-    ovals = dict()
-    for release in supported_releases:
-        # we can have nested parent releases
-        parent = release_progenitor(release)
-        index = '{0}_dpkg'.format(release)
-        ovals[index] = oval_lib.OvalGeneratorCVE(release, release_name(release), parent, warn, outdir, prefix='', oval_format='dpkg')
-        ovals[index].add_release_applicability_definition()
-        if oci:
-            index = '{0}_oci'.format(release)
-            ovals[index] = oval_lib.OvalGeneratorCVE(release, release_name(release), parent, warn, ocioutdir, prefix=ociprefix, oval_format='oci')
-            ovals[index].add_release_applicability_definition()
-
-    # loop through all CVE data files
-    files = []
-    for pathname in pathnames:
-        files = files + glob.glob(os.path.join(cve_prefix_dir, pathname))
-    files.sort()
-
-    pkg_filter = None
-    if packages:
-        pkg_filter = packages
-
-    files_count = len(files)
-    for i_file, filepath in enumerate(files):
-        cve_data = parse_cve_file(filepath, cache, pkg_filter)
-        # skip CVEs without packages for supported releases
-        if not cve_data['packages']:
-            if not no_progress:
-                progress_bar(i_file + 1, files_count)
-            continue
-
-        for i in ovals:
-            ovals[i].generate_cve_definition(cve_data)
-
-        if not no_progress:
-            progress_bar(i_file + 1, files_count)
+    if not no_progress:
+        print(f'[X] Done generating OVAL PKG for packages in releases {", ".join(releases)}')
+
+def generate_oval_cve(releases, outdir, cve_prefix_dir, pkg_cache, cve_cache, oci, no_progress, packages, pathnames, fixed_only, ocioutdir=None):
+    if not no_progress:
+        print(f'[*] Generating OVAL CVE for packages in releases {",".join(releases)}')
+
+    ov = oval_lib.OvalGeneratorCVE(
+        releases, 
+        pathnames, 
+        packages, 
+        not no_progress,
+        pkg_cache=pkg_cache, 
+        fixed_only=fixed_only, 
+        cve_cache=cve_cache, 
+        oval_format='dpkg',
+        outdir=outdir, 
+        cve_prefix_dir=cve_prefix_dir
+    )
+    ov.generate_oval()
+
+    if oci:
+        ov.oval_format = 'oci'
+        ov.output_dir = ocioutdir
+        ov.generate_oval()
 
-    for i in ovals:
-        ovals[i].write_to_file()
+    if not no_progress:
+        print(f'[X] Done generating OVAL CVE for packages in releases {", ".join(releases)}')
 
 if __name__ == '__main__':
     main()
diff --git a/scripts/oval_lib.py b/scripts/oval_lib.py
index 655f0af..abe63dc 100644
--- a/scripts/oval_lib.py
+++ b/scripts/oval_lib.py
@@ -22,7 +22,6 @@ from datetime import datetime, timezone
 import apt_pkg
 import io
 import os
-import random
 import re
 import shutil
 import sys
@@ -30,6 +29,7 @@ import tempfile
 import collections
 import glob
 import xml.etree.cElementTree as etree
+import json
 from xml.dom import minidom
 from typing import Tuple # Needed because of Python < 3.9 and to also support < 3.7
 
@@ -41,6 +41,7 @@ from xml.sax.saxutils import escape
 sources = {}
 source_map_binaries = {}
 debug_level = 0
+GENERIC_VERSION = '0:0'
 
 def recursive_rm(dirPath):
     '''recursively remove directory'''
@@ -143,80 +144,361 @@ def generate_cve_tag(cve):
     cve_ref += '>{0}</cve>'.format(cve['Candidate'])
     return cve_ref
 
-def get_latest_version(versions):
-    latest = None
-    for version in versions:
-        if not latest:
-            latest = version
-            continue
-        elif apt_pkg.version_compare(version, latest) > 0:
-            latest = version
-
-    return latest
-
-def get_binarypkgs(cache, source_name, release, version=None):
+def get_binarypkgs(cache, source_name, release):
     """ return a list of binary packages from the source package version """
     packages_to_ignore = ("-dev", "-doc", "-dbg", "-dbgsym", "-udeb", "-locale-")
-    version_map = collections.defaultdict(list)
-    cache_version = version
+    binaries_map = collections.defaultdict(dict)
 
     if source_name not in cache[release]:
         rel = release
         while cve_lib.release_parent(rel):
             rel = cve_lib.release_parent(rel)
-            r , sv, vm  = get_binarypkgs(cache, source_name, rel, version)
+            r , vb  = get_binarypkgs(cache, source_name, rel)
             if r:
-                return r, sv, vm
+                return r, vb
 
         # if a source package does not exist in such a release
         # return None
-        return release, None, None
-    elif version and version not in cache[release][source_name]:
-        rel = release
-        while cve_lib.release_parent(rel):
-            rel = cve_lib.release_parent(rel)
-            r , sv, vm  = get_binarypkgs(cache, source_name, rel, version)
-            if r:
-                return r, sv, vm
-
-        # if version is not in release, then fetch latest source version
-        cache_version = get_latest_version(list(cache[release][source_name].keys()))
-    elif not version:
-        # if no version is provided, get latest source version
-        version = get_latest_version(list(cache[release][source_name].keys()))
-        cache_version = version
-    else:
-        cache_version = version
+        return None, None
+    
+    for source_version in cache[release][source_name]:
+        binaries_map.setdefault(source_version, dict())
+        for binary, bin_data in cache[release][source_name][source_version]['binaries'].items():
+            # for kernel we only want linux images
+            if source_name.startswith('linux') and not binary.startswith('linux-image-'):
+                continue
+            # skip ignored packages, with exception of golang*-dev pkgs
+            if binary.startswith(('golang-go')) or \
+                    not any(s in binary for s in packages_to_ignore):
+                binaries_map[source_version].setdefault(bin_data['version'], list())
+                binaries_map[source_version][bin_data['version']].append(binary)
+
+    return release, binaries_map
+
+class CVEPkgRelEntry:
+    def __init__(self, pkg, release, cve, status, note) -> None:
+        self.pkg = pkg
+        self.cve = cve
+        self.orig_status = status
+        self.orig_note = note
+        self.release = release
+        cve_info = CVEPkgRelEntry.parse_package_status(self.release, pkg.name, status, note, cve.number, None)
+
+        self.note = cve_info['note']
+        self.status = cve_info['status']
+        self.fixed_version = cve_info['fix-version'] if self.status == 'fixed' else None
+
+    @staticmethod
+    def parse_package_status(release, package, status_text, note, filepath, cache):
+        """ parse ubuntu package status string format:
+            <status code> (<version/notes>)
+            outputs dictionary: {
+            'status'        : '<not-applicable | unknown | vulnerable | fixed>',
+            'note'          : '<description of the status>',
+            'fix-version'   : '<version with issue fixed, if applicable>',
+            'bin-pkgs'      : []
+            } """
+
+        # TODO fix for CVE Generator
+
+        # break out status code and detail
+        code = status_text.lower()
+        detail = note.strip('()') if note else None
+        status = {}
+        fix_version = ""
+
+        if detail and detail[0].isdigit() and len(detail.split(' ')) == 1:
+            fix_version = detail
+
+        note_end = " (note: '{0}').".format(detail) if detail else '.'
+        if code == 'dne':
+            status['status'] = 'not-applicable'
+            status['note'] = \
+                " package does not exist in {0}{1}".format(release, note_end)
+        elif code == 'ignored':
+            status['status'] = 'vulnerable'
+            status['note'] = ": while related to the CVE in some way, a decision has been made to ignore this issue{0}".format(note_end)
+        elif code == 'not-affected':
+            # check if there is a release version and if so, test for
+            # package existence with that version
+            if fix_version:
+                status['status'] = 'fixed'
+                status['note'] = " package in {0}, is related to the CVE in some way and has been fixed{1}".format(release, note_end)
+                status['fix-version'] = fix_version
+            else:
+                status['status'] = 'not-vulnerable'
+                status['note'] = " package in {0}, while related to the CVE in some way, is not affected{1}".format(release, note_end)
+        elif code == 'needed':
+            status['status'] = 'vulnerable'
+            status['note'] = \
+                " package in {0} is affected and needs fixing{1}".format(release, note_end)
+        elif code == 'pending':
+            # pending means that packages have been prepared and are in
+            # -proposed or in a ppa somewhere, and should have a version
+            # attached. If there is a version, test for package existence
+            # with that version, otherwise mark as vulnerable
+            if fix_version:
+                status['status'] = 'fixed'
+                status['note'] = " package in {0} is affected. An update containing the fix has been completed and is pending publication{1}".format(release, note_end)
+                status['fix-version'] = fix_version
+            else:
+                status['status'] = 'vulnerable'
+                status['note'] = " package in {0} is affected. An update containing the fix has been completed and is pending publication{1}".format(release, note_end)
+        elif code == 'deferred':
+            status['status'] = 'vulnerable'
+            status['note'] = " package in {0} is affected, but a decision has been made to defer addressing it{1}".format(release, note_end)
+        elif code in ['released']:
+            # if there isn't a release version, then just mark
+            # as vulnerable to test for package existence
+            if not fix_version:
+                status['status'] = 'vulnerable'
+                status['note'] = " package in {0} was vulnerable and has been fixed, but no release version available for it{1}".format(release, note_end)
+            else:
+                status['status'] = 'fixed'
+                status['note'] = " package in {0} was vulnerable but has been fixed{1}".format(release, note_end)
+                status['fix-version'] = fix_version
+        elif code == 'needs-triage':
+            status['status'] = 'vulnerable'
+            status['note'] = " package in {0} is affected and may need fixing{1}".format(release, note_end)
+        else:
+            # TODO LOGGIN
+            print('Unsupported status "{0}" in {1}_{2} in "{3}". Setting to "unknown".'.format(code, release, package, filepath))
+            status['status'] = 'unknown'
+            status['note'] = " package in {0} has a vulnerability that is not known (status: '{1}'). It is pending evaluation{2}".format(release, code, note_end)
+
+        return status
+
+    def is_not_applicable(self) -> bool:
+        return self.status in ['not-vulnerable', 'not-applicable']
+
+    def __str__(self) -> str:
+        return f'{str(self.pkg)}:{self.status} {self.fixed_version}'
+
+class CVE:
+    def __init__(self, number, info, pkgs=None) -> None:
+        self.number = number
+        self.description = info['Description']
+        self.priority = info['Priority'][0]
+        self.public_date = info['PublicDate']
+        self.public_date_at_usn = info['PublicDateAtUSN'] if 'PublicDateAtUSN' in info else ''
+        self.cvss = info['CVSS']
+        self.assigned_to = info['Assigned-to'] if 'Assigned-to' in info else ''
+        self.discoverd_by = info['Discovered-by'] if 'Discovered-by' in info else ''
+        self.usns = []
+        self.references = []
+        self.bugs = []
+        for url in info['References'].split('\n'):
+            if 'https://ubuntu.com/security/notices/USN-' in url:
+                self.usns.append(url[40:])
+            elif re.match("https?:\/\/(bugs\.)?launchpad\.net\/(.*\/\+bug|bugs)\/\d+", url):
+                self.bugs.append(url)
+            elif url:
+                self.references.append(url)
+        
+        for bug in info['Bugs'].split('\n'):
+            if bug:
+                self.bugs.append(bug)
+
+        self.pkg_rel_entries = {}
+        self.pkgs = pkgs if pkgs else []
+
+    def get_pkgs(self, releases):
+        # We assume priority is as the order in the list
+        pkgs = []
+        pkg_rel = {}
+        for pkg in self.pkgs:
+            if pkg.rel not in releases:
+                continue
+            
+            if pkg.name not in pkg_rel:
+                pkg_rel[pkg.name] = pkg.rel
+            elif releases.index(pkg.rel) < releases.index(pkg_rel[pkg.name]):
+                pkg_rel[pkg.name] = pkg.rel
+        
+        for pkg in self.pkgs:
+            if self.pkg_rel_entries[str(pkg)].is_not_applicable():
+                continue
+
+            if pkg.name in pkg_rel and pkg_rel[pkg.name] == pkg.rel:
+                pkgs.append(pkg)
+        
+        return pkgs
+
+
+    def add_pkg(self, pkg_object, release, state, note):
+        cve_pkg_entry = CVEPkgRelEntry(pkg_object, release, self, state, note)
+        self.pkg_rel_entries[str(pkg_object)] = cve_pkg_entry
+        self.pkgs.append(pkg_object)
+        pkg_object.add_cve(self)
+
+    def __str__(self) -> str:
+        return self.number
+
+    def __repr__(self):
+        return self.__str__()
+
+class Package:
+    def __init__(self, pkgname, rel, versions_binaries):
+        self.name = pkgname
+        self.rel = rel
+        self.description = cve_lib.lookup_package_override_description(pkgname)
+
+        if not self.description:
+            if 'description' in sources[rel][pkgname]:
+                self.description = sources[rel][pkgname]['description']
+            elif pkgname in source_map_binaries[rel] and \
+                'description' in source_map_binaries[rel][pkgname]:
+                self.description = source_map_binaries[rel][pkgname]['description']
+            else:
+                # Get first description found
+                if 'binaries' in sources[self.rel][self.name]:
+                    for binary in sources[self.rel][self.name]['binaries']:
+                        if binary in source_map_binaries[self.rel] and 'description' in source_map_binaries[self.rel][binary]:
+                            self.description = source_map_binaries[self.rel][binary]["description"]
+                            break
+
+        self.section = sources[rel][pkgname]['section']
+        self.versions_binaries = versions_binaries if versions_binaries else {}
+        self.earliest_version = self.get_earliest_version()
+        self.latest_version = self.get_latest_version()
+
+        binary_versions = self.get_binary_versions(self.earliest_version)
+        self.is_kernel_pkg = False if len(binary_versions) == 0 else \
+            is_kernel_binaries(self.get_binaries(self.earliest_version, binary_versions[0]))
+        self.cves = []
+
+    def add_cve(self, cve) -> None:
+        self.cves.append(cve)
+
+    def get_latest_version(self):
+        latest = None
+        for version in self.versions_binaries.keys():
+            if not latest:
+                latest = version
+                continue
+            elif apt_pkg.version_compare(version, latest) > 0:
+                latest = version
+
+        return latest
+
+    def get_earliest_version(self):
+        earliest = None
+        for version in self.versions_binaries.keys():
+            if not earliest:
+                earliest = version
+                continue
+            elif apt_pkg.version_compare(earliest, version) > 0:
+                earliest = version
+
+        return earliest
+
+    def version_exists(self, source_version):
+        return source_version in self.versions_binaries
+    
+    def all_binaries_same_version(self, source_version):
+        if source_version not in self.versions_binaries:
+            return len(self.versions_binaries[self.earliest_version]) <= 1
+        return len(self.versions_binaries[source_version]) <= 1
+
+    def get_version_to_check(self, source_version):
+        if not source_version:
+            return self.latest_version
+        else:
+            if source_version in self.versions_binaries or self.all_binaries_same_version(source_version):
+                return source_version
+            else:
+                if source_version and apt_pkg.version_compare(source_version, self.earliest_version) > 0:
+                    print(f'Wrong CVE entry version {source_version} - earliest for package {self.name} in {self.rel} is {self.earliest_version}')
+
+                return self.earliest_version
+
+    def get_binary_versions(self, source_version):
+        if not self.versions_binaries: return []
+
+        if source_version not in self.versions_binaries:
+            # If this is the case, package binaries should all have the same version
+            # Relying on that, we can use the version of the CVE as the right version
+            return [source_version]
+        return list(self.versions_binaries[source_version].keys())
+
+    def get_binaries(self, source_version, binary_version):
+        if not self.versions_binaries: return {}
+        if source_version not in self.versions_binaries:
+            if len(self.versions_binaries[self.earliest_version]) != 1:
+                print(f"WARN: Version {source_version} doesn't exist yet the package {self.name} has different versions for the binaries")
+
+            version_binaries = self.versions_binaries[self.earliest_version]
+            return version_binaries[self.get_binary_versions(self.earliest_version)[0]]
+        return self.versions_binaries[source_version][binary_version]
+
+    def __str__(self) -> str:
+        return f"{self.name}/{self.rel}"
 
-    for binary, bin_data in cache[release][source_name][cache_version]['binaries'].items():
-        # for kernel we only want linux images
-        if source_name.startswith('linux') and not binary.startswith('linux-image-'):
-            continue
-        # skip ignored packages, with exception of golang*-dev pkgs
-        if binary.startswith(('golang-go')) or \
-                not any(s in binary for s in packages_to_ignore):
-            version_map[bin_data['version']].append(binary)
+    def __repr__(self):
+        return self.__str__()
+
+class USN:
+    def __init__(self, data):
+        for item in ['description', 'releases', 'title', 'timestamp', 'summary', 'action', 'cves', 'id', 'isummary']:
+            if item in data:
+                setattr(self, item, data[item])
+            else:
+                setattr(self, item, None)
+    
+    def __str__(self) -> str:
+        return self.id
 
-    return release, version, version_map
+    def __repr__(self) -> str:
+        return self.id
 
+# Oval Generators
 class OvalGenerator:
     supported_oval_elements = ('definition', 'test', 'object', 'state', 'variable')
-    generator_version = '1.1'
+    generator_version = '2'
     oval_schema_version = '5.11.1'
-    def __init__(self, release, release_name = None, warn_method=False, outdir='./', prefix='', oval_format='dpkg') -> None:
-        self.release = release
-        # e.g. codename for trusty/esm should be trusty
-        self.release_codename = cve_lib.release_progenitor(release) if cve_lib.release_progenitor(release) else self.release.replace('/', '_')
-        self.release_name = release_name
-        #self.warn = warn_method or self.warn
-        self.tmpdir = tempfile.mkdtemp(prefix='oval_lib-')
+    def __init__(self, type, releases, cve_paths, packages, progress, pkg_cache, fixed_only=True, cve_cache=None,  cve_prefix_dir=None, outdir='./', oval_format='dpkg') -> None:
+        self.releases = releases
         self.output_dir = outdir
         self.oval_format = oval_format
+        self.generator_type = type
+        self.progress = progress
+        self.cve_cache = cve_cache
+        self.pkg_cache = pkg_cache
+        self.cve_paths = cve_paths
+        self.fixed_only = fixed_only
+        self.packages, self.cves = self._load(cve_prefix_dir, packages)
+
+    def _init_ids(self, release):
+        # e.g. codename for trusty/esm should be trusty
+        self.release = release
+        self.release_codename = cve_lib.release_progenitor(self.release) if cve_lib.release_progenitor(self.release) else self.release.replace('/', '_')
+        self.release_name = cve_lib.release_name(self.release)
+        
+        self.parent_releases = set()
+        current_release = self.release
+        while(cve_lib.release_parent(current_release)):
+            current_release = cve_lib.release_parent(current_release)
+            if current_release != self.release:
+                self.parent_releases.add(current_release)
+        
         self.ns = 'oval:com.ubuntu.{0}'.format(self.release_codename)
         self.id = 100
         self.host_def_id = self.id
         self.release_applicability_definition_id = '{0}:def:{1}0'.format(self.ns, self.id)
-
+        ###
+        # ID schema: 2204|00001|0001
+        # * The first four digits are the ubuntu release number
+        # * The next 5 digits is # just a package counter, we increase it for each definition
+        # * The last 4 digits is a counter for the criterion
+        ###
+        release_code = int(self.release_name.split(' ')[1].replace('.', '')) if self.release not in cve_lib.external_releases else 1111
+        self.release_id = release_code * 10 ** 10
+        self.definition_id = self.release_id
+        self.definition_step = 1 * 10 ** 5
+        self.criterion_step = 10
+        self.output_filepath = \
+            '{0}com.ubuntu.{1}.{2}.oval.xml'.format('oci.' if self.oval_format == 'oci' else '', self.release.replace('/', '_'), self.generator_type)
+        
     def _add_structure(self, root) -> None:
         structure = {}
         for element in self.supported_oval_elements:
@@ -225,21 +507,11 @@ class OvalGenerator:
 
         return structure
 
-    def _get_root_element(self, type) -> etree.Element:
+    def _get_generator(self, type) -> etree.Element:
         oval_timestamp = datetime.now(tz=timezone.utc).strftime(
             '%Y-%m-%dT%H:%M:%S')
 
-        root_element = etree.Element("oval_definitions", attrib= {
-            "xmlns":"http://oval.mitre.org/XMLSchema/oval-definitions-5",
-            "xmlns:ind-def":"http://oval.mitre.org/XMLSchema/oval-definitions-5#independent",
-            "xmlns:oval":"http://oval.mitre.org/XMLSchema/oval-common-5",
-            "xmlns:unix-def":"http://oval.mitre.org/XMLSchema/oval-definitions-5#unix",
-            "xmlns:linux-def":"http://oval.mitre.org/XMLSchema/oval-definitions-5#linux",
-            "xmlns:xsi":"http://www.w3.org/2001/XMLSchema-instance" ,
-            "xsi:schemaLocation":"http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd   http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd   http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd   http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd   http://oval.mitre.org/XMLSchema/oval-definitions-5#macos linux-definitions-schema.xsd"
-        })
-
-        generator = etree.SubElement(root_element, "generator")
+        generator = etree.Element("generator")
         product_name = etree.SubElement(generator, "oval:product_name")
         product_version = etree.SubElement(generator, "oval:product_version")
         schema_version = etree.SubElement(generator, "oval:schema_version")
@@ -250,6 +522,19 @@ class OvalGenerator:
         schema_version.text = self.oval_schema_version
         timestamp.text = oval_timestamp
 
+        return generator
+
+    def _get_root_element(self) -> etree.Element:
+        root_element = etree.Element("oval_definitions", attrib= {
+            "xmlns":"http://oval.mitre.org/XMLSchema/oval-definitions-5",
+            "xmlns:ind-def":"http://oval.mitre.org/XMLSchema/oval-definitions-5#independent",
+            "xmlns:oval":"http://oval.mitre.org/XMLSchema/oval-common-5",
+            "xmlns:unix-def":"http://oval.mitre.org/XMLSchema/oval-definitions-5#unix",
+            "xmlns:linux-def":"http://oval.mitre.org/XMLSchema/oval-definitions-5#linux",
+            "xmlns:xsi":"http://www.w3.org/2001/XMLSchema-instance" ,
+            "xsi:schemaLocation":"http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd   http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd   http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd   http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd   http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd"
+        })
+
         xml_tree = etree.ElementTree(root_element)
         return xml_tree, root_element
 
@@ -396,229 +681,90 @@ class OvalGenerator:
 
         return family_state, state
 
-class CVEPkgRelEntry:
-    def __init__(self, pkg, release, cve, status, note, cache) -> None:
-        self.pkg = pkg
-        self.cve = cve
-        self.orig_status = status
-        self.orig_note = note
-        self.release = release
-        cve_info = CVEPkgRelEntry.parse_package_status(self.release, pkg.name, status, note, cve.number, cache)
+    def _add_new_package(self, package_name, cve, release, cve_data, packages) -> None:
+        if package_name not in packages:
+            _, versions_binaries = get_binarypkgs(self.pkg_cache, package_name, release)
+            pkg_obj = Package(package_name, release, versions_binaries)
+            packages[package_name] = pkg_obj
 
-        self.note = cve_info['note']
-        self.status = cve_info['status']
-        self.fixed_version = cve_info['fix-version'] if self.status == 'fixed' else None
+        pkg_obj = packages[package_name]
+        cve.add_pkg(pkg_obj, release, cve_data['pkgs'][package_name][release][0],cve_data['pkgs'][package_name][release][1])
 
-    @staticmethod
-    def parse_package_status(release, package, status_text, note, filepath, cache):
-        """ parse ubuntu package status string format:
-            <status code> (<version/notes>)
-            outputs dictionary: {
-            'status'        : '<not-applicable | unknown | vulnerable | fixed>',
-            'note'          : '<description of the status>',
-            'fix-version'   : '<version with issue fixed, if applicable>',
-            'bin-pkgs'      : []
-            } """
+    def _load(self, cve_prefix_dir, packages_filter=None) -> None:
+        cve_lib.load_external_subprojects()
 
-        # TODO fix for CVE Generator
+        cve_paths = []
+        for pathname in self.cve_paths:
+            cve_paths = cve_paths + glob.glob(os.path.join(cve_prefix_dir, pathname))
 
-        # break out status code and detail
-        code = status_text.lower()
-        detail = note.strip('()') if note else None
-        status = {}
-        fix_version = None
+        cve_paths.sort(key=lambda cve:
+                   (int(cve.split('/')[-1].split('-')[1]), int(cve.split('/')[-1].split('-')[2])) \
+                    if cve.split('/')[-1].split('-')[2].isnumeric() \
+                    else (int(cve.split('/')[-1].split('-')[1]), 0)
+                 )
 
-        if detail and detail[0].isdigit() and len(detail.split(' ')) == 1:
-            fix_version = detail
+        packages = {}
+        cves = {}
+        base_releases = self.releases
+        final_releases = set(self.releases)
+        for current_release in base_releases:
+            while(cve_lib.release_parent(current_release)):
+                current_release = cve_lib.release_parent(current_release)
+                final_releases.add(current_release)
+
+        for release in final_releases:
+            packages.setdefault(release, {})
+            cves.setdefault(release, {})
+            sources[release] = load(releases=[release], skip_eol_releases=False)[release]
 
-        parent = release
-        if cache and code != 'dne':
-            parent, status['source-version'], status['bin-pkgs'] = get_binarypkgs(cache, package, release, version=fix_version)
-            if parent != release:
-                status['parent'] = parent
+            orig_name = cve_lib.get_orig_rel_name(release)
+            if '/' in orig_name:
+                orig_name = orig_name.split('/', maxsplit=1)[1]
+            source_map_binaries[release] = load(data_type='packages',releases=[orig_name], skip_eol_releases=False)[orig_name] \
+                if release not in cve_lib.external_releases else {}
 
-        note_end = " (note: '{0}').".format(detail) if detail else '.'
-        if code == 'dne':
-            status['status'] = 'not-applicable'
-            status['note'] = \
-                " package does not exist in {0}{1}".format(release, note_end)
-        elif code == 'ignored':
-            status['status'] = 'vulnerable'
-            status['note'] = ": while related to the CVE in some way, a decision has been made to ignore this issue{0}".format(note_end)
-        elif code == 'not-affected':
-            # check if there is a release version and if so, test for
-            # package existence with that version
-            if fix_version:
-                status['status'] = 'fixed'
-                status['note'] = " package in {0}, is related to the CVE in some way and has been fixed{1}".format(parent, note_end)
-                status['fix-version'] = fix_version
-            else:
-                status['status'] = 'not-vulnerable'
-                status['note'] = " package in {0}, while related to the CVE in some way, is not affected{1}".format(parent, note_end)
-        elif code == 'needed':
-            status['status'] = 'vulnerable'
-            status['note'] = \
-                " package in {0} is affected and needs fixing{1}".format(parent, note_end)
-        elif code == 'pending':
-            # pending means that packages have been prepared and are in
-            # -proposed or in a ppa somewhere, and should have a version
-            # attached. If there is a version, test for package existence
-            # with that version, otherwise mark as vulnerable
-            if fix_version:
-                status['status'] = 'fixed'
-                status['note'] = " package in {0} is affected. An update containing the fix has been completed and is pending publication{1}".format(parent, note_end)
-                status['fix-version'] = fix_version
-            else:
-                status['status'] = 'vulnerable'
-                status['note'] = " package in {0} is affected. An update containing the fix has been completed and is pending publication{1}".format(parent, note_end)
-        elif code == 'deferred':
-            status['status'] = 'vulnerable'
-            status['note'] = " package in {0} is affected, but a decision has been made to defer addressing it{1}".format(parent, note_end)
-        elif code in ['released']:
-            # if there isn't a release version, then just mark
-            # as vulnerable to test for package existence
-            if not fix_version:
-                status['status'] = 'vulnerable'
-                status['note'] = " package in {0} was vulnerable and has been fixed, but no release version available for it{1}".format(parent, note_end)
-            else:
-                status['status'] = 'fixed'
-                status['note'] = " package in {0} was vulnerable but has been fixed{1}".format(parent, note_end)
-                status['fix-version'] = fix_version
-        elif code == 'needs-triage':
-            status['status'] = 'vulnerable'
-            status['note'] = " package in {0} is affected and may need fixing{1}".format(parent, note_end)
-        else:
-            # TODO LOGGIN
-            print('Unsupported status "{0}" in {1}_{2} in "{3}". Setting to "unknown".'.format(code, release, package, filepath))
-            status['status'] = 'unknown'
-            status['note'] = " package in {0} has a vulnerability that is not known (status: '{1}'). It is pending evaluation{2}".format(release, code, note_end)
-
-        return status
-
-    def __str__(self) -> str:
-        return f'{str(self.pkg)}:{self.status} {self.fixed_version}'
-
-class CVE:
-    def __init__(self, number, info, pkgs=[]) -> None:
-        self.number = number
-        self.description = info['Description']
-        self.priority = info['Priority'][0]
-        self.public_date = info['PublicDate']
-        self.cvss = info['CVSS']
-        self.usns = []
-        for url in info['References'].split('\n'):
-            if 'https://ubuntu.com/security/notices/USN-' in url:
-                self.usns.append(url[40:])
-        self.pkg_rel_entries = {}
-        self.pkgs = pkgs
-
-    def add_pkg(self, pkg_object, cve_pkg_entry):
-        if cve_pkg_entry.status in ['not-vulnerable', 'not-applicable']:
-            return
-
-        self.pkg_rel_entries[pkg_object.name] = cve_pkg_entry
-        self.pkgs.append(pkg_object)
-        pkg_object.cves.append(self)
-
-    def __str__(self) -> str:
-        return self.number
-
-    def __repr__(self):
-        return self.__str__()
-
-class Package:
-    def __init__(self, pkgname, rel, binaries, version):
-        self.name = pkgname
-        self.rel = rel
-        self.description = cve_lib.lookup_package_override_description(pkgname)
-
-        if not self.description:
-            if 'description' in sources[rel][pkgname]:
-                self.description = sources[rel][pkgname]['description']
-            elif pkgname in source_map_binaries[rel] and \
-                'description' in source_map_binaries[rel][pkgname]:
-                self.description = source_map_binaries[rel][pkgname]['description']
-            else:
-                # Get first description found
-                if 'binaries' in sources[self.rel][self.name]:
-                    for binary in sources[self.rel][self.name]['binaries']:
-                        if binary in source_map_binaries[self.rel] and 'description' in source_map_binaries[self.rel][binary]:
-                            self.description = source_map_binaries[self.rel][binary]["description"]
-                            break
-
-        self.section = sources[rel][pkgname]['section']
-        self.version = version
-        self.binaries = binaries if binaries else []
-        self.cves = []
-
-    def add_cve(self, cve) -> None:
-        self.cves.append(cve)
-
-    def __str__(self) -> str:
-        return f"{self.name}/{self.rel}"
-
-    def __repr__(self):
-        return self.__str__()
-
-class OvalGeneratorPkg(OvalGenerator):
-    def __init__(self, release, release_name, cve_paths, packages, progress, pkg_cache, fixed_only=True, cve_cache=None,  cve_prefix_dir=None, warn_method=False, outdir='./', prefix='', oval_format='dpkg') -> None:
-        super().__init__(release, release_name, warn_method, outdir, prefix, oval_format)
-        self.progress = progress
-        self.cve_cache = cve_cache
-        self.pkg_cache = pkg_cache
-        self.cve_paths = cve_paths
-        self.fixed_only = fixed_only
-        self.packages = self._load_pkgs(cve_prefix_dir, packages)
-
-    def _reset(self):
-        ###
-        # ID schema: 2204|00001|0001
-        # * The first four digits are the ubuntu release number
-        # * The next 5 digits is # just a package counter, we increase it for each definition
-        # * The last 4 digits is a counter for the criterion
-        ###
-        release_code = int(self.release_name.split(' ')[1].replace('.', '')) if self.release not in cve_lib.external_releases else 1111
-        self.definition_id = release_code * 10 ** 10
-        self.definition_step = 1 * 10 ** 5
-        self.criterion_step = 10
-        self.output_filepath = \
-            '{0}com.ubuntu.{1}.pkg.oval.xml'.format('oci.' if self.oval_format == 'oci' else '', self.release.replace('/', '_'))
+        i = 0
+        for cve_path in cve_paths:
+            cve_number = cve_path.rsplit('/', 1)[1]
+            i += 1
 
-    def _generate_advisory(self, package: Package) -> etree.Element:
-        advisory = etree.Element("advisory")
-        rights = etree.SubElement(advisory, "rights")
-        component = etree.SubElement(advisory, "component")
-        version = etree.SubElement(advisory, "current_version")
+            if self.progress:
+                print(f'[{i:5}/{len(cve_paths)}] Processing {cve_number:18}', end='\r')
 
-        for cve in package.cves:
-            if self.fixed_only and cve.pkg_rel_entries[package.name].status != 'fixed':
-                continue
-            cve_obj = self._generate_cve_tag(cve)
-            advisory.append(cve_obj)
+            if not cve_number in self.cve_cache:
+                self.cve_cache[cve_number] = cve_lib.load_cve(cve_path)
 
-        rights.text = f"Copyright (C) {datetime.now().year} Canonical Ltd."
-        component.text = package.section
-        version.text = package.version
+            info = self.cve_cache[cve_number]
+            cve_obj = CVE(cve_number, info)
+            for pkg in info['pkgs']:
+                if packages_filter and pkg not in packages_filter:
+                    continue
 
-        return advisory
+                for release in final_releases:
+                    if pkg in sources[release] and release in info['pkgs'][pkg] and \
+                        info['pkgs'][pkg][release][0] != 'DNE':
+                            self._add_new_package(pkg, cve_obj, release, info, packages[release])
+                            if cve_number not in cves[release]:
+                                cves[release][cve_number] = cve_obj
 
-    def _generate_metadata(self, package: Package) -> etree.Element:
-        metadata = etree.Element("metadata")
-        title = etree.SubElement(metadata, "title")
-        reference = self._generate_reference(package)
-        advisory = self._generate_advisory(package)
-        metadata.append(reference)
-        description = etree.SubElement(metadata, "description")
-        affected = etree.SubElement(metadata, "affected", attrib = {"family": "unix"})
-        platform = etree.SubElement(affected, "platform")
-        metadata.append(advisory)
+        for release in final_releases:
+            packages[release] = dict(sorted(packages[release].items()))
+            cves[release] = dict(sorted(cves[release].items()))
 
-        platform.text = self.release_name
-        title.text = package.name
-        description.text = package.description
+        if self.progress:
+            print(' ' * 40, end='\r')
+        return packages, cves
 
-        return metadata
+    def _write_oval_xml(self, xml_tree: etree.ElementTree, root_element: etree.ElementTree) -> None:
+        if sys.version_info[0] >= 3 and sys.version_info[1] >= 9:
+            etree.indent(xml_tree, level=0) # indent only available from Python 3.9
+            xml_tree.write(os.path.join(self.output_dir, self.output_filepath))
+        else:
+            xmlstr = minidom.parseString(etree.tostring(root_element)).toprettyxml(indent="  ")
+            with open(os.path.join(self.output_dir, self.output_filepath), 'w') as file:
+                file.write(xmlstr)
 
+    # Object generators
     def _generate_criteria(self) -> etree.Element:
         criteria = etree.Element("criteria")
         if self.oval_format == 'dpkg':
@@ -629,38 +775,15 @@ class OvalGeneratorPkg(OvalGenerator):
             extend_definition.set("applicability_check", "true")
 
         return criteria
-
-    def _generate_subcriteria(self, operator) -> etree.Element:
-        return etree.Element("criteria", attrib={
-            "operator": operator
-        })
-
-    def _generate_criterion_element(self, comment, id) -> etree.Element:
-        criterion = etree.Element("criterion", attrib={
-            "test_ref": f"{self.ns}:tst:{id}",
-            "comment": comment
-        })
-
-        return criterion
-
-    # Element generators
-    def _generate_reference(self, package) -> etree.Element:
-        reference = etree.Element("reference", attrib={
-            "source": "Package",
-            "ref_id": package.name,
-            "ref_url": f'https://launchpad.net/ubuntu/+source/{package.name}'
-        })
-
-        return reference
-
-    def _generate_definition_element(self, package) -> None:
+    
+    def _generate_definition_object(self, object) -> etree.Element:
         id = f"{self.ns}:def:{self.definition_id}"
         definition = etree.Element("definition")
         definition.set("class", "vulnerability")
         definition.set("id", id)
         definition.set("version", "1")
 
-        metadata = self._generate_metadata(package)
+        metadata = self._generate_metadata(object)
         criteria = self._generate_criteria()
         definition.append(metadata)
         definition.append(criteria)
@@ -692,7 +815,7 @@ class OvalGeneratorPkg(OvalGenerator):
                 cve_tag.set('usns', ','.join(cve.usns))
 
         return cve_tag
-
+    
     def _generate_var_element(self, comment, id, binaries) -> etree.Element:
         var = etree.Element("constant_variable",
             attrib={
@@ -813,6 +936,72 @@ class OvalGeneratorPkg(OvalGenerator):
 
         return object
 
+    def _generate_criterion_element(self, comment, id) -> etree.Element:
+        criterion = etree.Element("criterion", attrib={
+            "test_ref": f"{self.ns}:tst:{id}",
+            "comment": comment
+        })
+
+        return criterion
+
+    def _generate_vulnerable_elements(self, package, binaries, obj_id=None):
+        binary_keyword = 'binaries' if len(binaries) > 1 else 'binary'
+        test_note = f"Does the '{package.name}' package exist?"
+        object_note = f"The '{package.name}' package {binary_keyword}"
+
+        test = self._generate_test_element(test_note, self.definition_id, False, 'pkg', obj_id=obj_id)
+
+        if not obj_id:
+            object = self._generate_object_element(object_note, self.definition_id, self.definition_id)
+
+            if package.is_kernel_pkg:
+                regex = process_kernel_binaries(binaries, 'oci')
+                binaries = [f'{regex}']
+
+            final_binaries = []
+            if self.oval_format == 'oci':
+                variable_values = '(?::\w+|)\s+(.*)$'
+                for binary in binaries:
+                    final_binaries.append(f'^{binary}{variable_values}')
+            else:
+                final_binaries = binaries
+
+            var = self._generate_var_element(object_note, self.definition_id, final_binaries)
+        else:
+            object = None
+            var = None
+        return test, object, var
+
+    def _generate_fixed_elements(self, package, binaries, version, obj_id=None):
+        binary_keyword = 'binaries' if len(binaries) > 1 else 'binary'
+        test_note = f"Does the '{package.name}' package exist and is the version less than '{version}'?"
+        object_note = f"The '{package.name}' package {binary_keyword}"
+        state_note = f"The package version is less than '{version}'"
+
+        test = self._generate_test_element(test_note, self.definition_id, True, 'pkg', obj_id=obj_id)
+        if not obj_id:
+            object = self._generate_object_element(object_note, self.definition_id, self.definition_id)
+
+            final_binaries = binaries
+            if self.oval_format == 'oci':
+                if package.is_kernel_pkg:
+                    regex = process_kernel_binaries(binaries, 'oci')
+                    final_binaries = [f'^{regex}(?::\w+|)\s+(.*)$']
+                else:
+                    variable_values = '(?::\w+|)\s+(.*)$'
+
+                    final_binaries = []
+                    for binary in binaries:
+                        final_binaries.append(f'^{binary}{variable_values}')
+
+            var = self._generate_var_element(object_note, self.definition_id, final_binaries)
+        else:
+            object = None
+            var = None
+        state = self._generate_state_element(state_note, self.definition_id, version)
+
+        return test, object, var, state
+
     # Running kernel element generators
     def _add_running_kernel_checks(self, root_element):
         objects = root_element.find("objects")
@@ -890,6 +1079,11 @@ class OvalGeneratorPkg(OvalGenerator):
         return test
 
     # Kernel elements generators
+    def _generate_criteria_kernel(self, operator) -> etree.Element:
+        return etree.Element("criteria", attrib={
+            "operator": operator
+        })
+
     def _generate_kernel_version_object_element(self, id, var_id) -> etree.Element:
         object = etree.Element("ind-def:variable_object",
             attrib={
@@ -924,12 +1118,12 @@ class OvalGeneratorPkg(OvalGenerator):
         value.text = f"0:{patched}"
         return state
 
-    def _generate_kernel_package_elements(self, package: Package, root_element, running_kernel_check_id) -> etree.Element:
+    def _generate_kernel_package_elements(self, package: Package, binaries, root_element, running_kernel_check_id) -> etree.Element:
         tests = root_element.find("tests")
         states = root_element.find("states")
 
         comment_running_kernel = f'Is kernel {package.name} running?'
-        regex = process_kernel_binaries(package.binaries, self.oval_format)
+        regex = process_kernel_binaries(binaries, self.oval_format)
 
         criterion_running_kernel = self._generate_criterion_element(comment_running_kernel, self.definition_id)
         test_running_kernel = self._generate_test_element_running_kernel(self.definition_id, comment_running_kernel, running_kernel_check_id)
@@ -942,22 +1136,25 @@ class OvalGeneratorPkg(OvalGenerator):
 
         return criterion_running_kernel
 
-    def _add_fixed_kernel_elements(self, cve: CVE, package: Package, package_rel_entry:CVEPkgRelEntry, root_element, running_kernel_id, fixed_versions) -> etree.Element:
+    def _add_kernel_elements(self, cve: CVE, package: Package, version, package_rel_entry:CVEPkgRelEntry, root_element, running_kernel_id, fixed_versions) -> etree.Element:
         tests = root_element.find("tests")
         objects = root_element.find("objects")
         states = root_element.find("states")
 
         comment_version = f'Kernel {package.name} version comparison'
-        comment_criterion = f'({cve.number}) {package.name} {package_rel_entry.note}'
+        comment_criterion = ''
+        if self.generator_type == 'pkg':
+            comment_criterion = f'({cve.number}) '
+        comment_criterion = comment_criterion + f'{package.name}{package_rel_entry.note}'
 
-        if package_rel_entry.fixed_version in fixed_versions:
-            criterion_version = self._generate_criterion_element(comment_criterion, fixed_versions[package_rel_entry.fixed_version])
+        if version in fixed_versions:
+            criterion_version = self._generate_criterion_element(comment_criterion, fixed_versions[version])
         else:
             create_state = False
 
-            if package_rel_entry.fixed_version:
+            if version:
                 create_state = True
-                ste_kernel_version = self._generate_state_kernel_element("Kernel check", self.definition_id, package_rel_entry.fixed_version)
+                ste_kernel_version = self._generate_state_kernel_element("Kernel check", self.definition_id, version)
                 states.append(ste_kernel_version)
 
             obj_kernel_version = self._generate_kernel_version_object_element(self.definition_id, running_kernel_id)
@@ -969,7 +1166,7 @@ class OvalGeneratorPkg(OvalGenerator):
             tests.append(test_kernel_version)
             objects.append(obj_kernel_version)
 
-            fixed_versions[package_rel_entry.fixed_version] = self.definition_id
+            fixed_versions[version] = self.definition_id
 
         return criterion_version
 
@@ -977,8 +1174,10 @@ class OvalGeneratorPkg(OvalGenerator):
     def _increase_id(self, is_definition):
         if is_definition:
             self.definition_id += self.definition_step
-            clean_value = self.definition_step / 10
-            self.definition_id = int(int(self.definition_id / clean_value) * clean_value)
+            # Ugly hack, Python doesn't like operating big numbers
+            criterion_appendix_length = len(str(self.definition_step)) - 1
+            self.definition_id = int(str(self.definition_id)[: -1 * criterion_appendix_length])
+            self.definition_id = int(self.definition_id * self.definition_step)
         else:
             self.definition_id += self.criterion_step
 
@@ -994,99 +1193,177 @@ class OvalGeneratorPkg(OvalGenerator):
         criteria.append(element)
 
     def _add_criterion(self, id, package_entry, cve, definition, depth=2) -> None:
-        criterion_note = f'({cve.number}) {package_entry.pkg.name}{package_entry.note}'
+        criterion_note = f'({cve.number}) ' if self.generator_type == 'pkg' else ''
+        criterion_note += f'{package_entry.pkg.name}{package_entry.note}'
         criterion = self._generate_criterion_element(criterion_note, id)
         self._add_to_criteria(definition, criterion, depth)
 
-    def _generate_elements(self, package, binaries, pkg_rel_entry, obj_id=None):
+    def _generate_elements(self, package, binaries, version, pkg_rel_entry, obj_id=None):
         create_state = False
         state = None
         var = None
         obj = None
-        binary_keyword = 'binaries' if len(package.binaries) > 1 else 'binary'
+        binary_keyword = 'binaries' if len(binaries) > 1 else 'binary'
         object_note = f"The '{package.name}' package {binary_keyword}"
         test_note = ""
 
+        final_binaries = binaries
         if self.oval_format == 'oci':
-            if is_kernel_binaries(package.binaries):
-                regex = process_kernel_binaries(package.binaries, 'oci')
-                binaries = [f'^{regex}(?::\w+|)\s+(.*)$']
+            if package.is_kernel_pkg:
+                regex = process_kernel_binaries(binaries, 'oci')
+                final_binaries = [f'^{regex}(?::\w+|)\s+(.*)$']
             else:
                 variable_values = '(?::\w+|)\s+(.*)$'
 
-                binaries = []
-                for binary in package.binaries:
-                    binaries.append(f'^{binary}{variable_values}')
+                final_binaries = []
+                for binary in binaries:
+                    final_binaries.append(f'^{binary}{variable_values}')
 
         if pkg_rel_entry.status == 'vulnerable':
             test_note = f"Does the '{package.name}' package exist?"
         elif pkg_rel_entry.status == 'fixed':
-            test_note = f"Does the '{package.name}' package exist and is the version less than '{pkg_rel_entry.fixed_version}'?"
-            state_note = f"The package version is less than '{pkg_rel_entry.fixed_version}'"
+            test_note = f"Does the '{package.name}' package exist and is the version less than '{version}'?"
+            state_note = f"The package version is less than '{version}'"
 
-            state = self._generate_state_element(state_note, self.definition_id, pkg_rel_entry.fixed_version)
+            state = self._generate_state_element(state_note, self.definition_id, version)
             create_state = True
 
-        if not obj_id or create_state:
-            obj_id = None
-
-            var = self._generate_var_element(object_note, self.definition_id, binaries)
-
+        if not obj_id:
+            var = self._generate_var_element(object_note, self.definition_id, final_binaries)
             obj = self._generate_object_element(object_note, self.definition_id, self.definition_id)
 
         test = self._generate_test_element(test_note, self.definition_id, create_state, 'pkg', obj_id=obj_id)
 
         return test, obj, var, state
 
-    def _populate_pkg(self, package, root_element):
-        tests = root_element.find("tests")
-        objects = root_element.find("objects")
-        variables = root_element.find("variables")
-        states = root_element.find("states")
+    # returns True if we should ignore this source package; primarily used
+    # for -edge kernels
+    def _ignore_source_package(self, source):
+        if re.match('linux-.*-edge$', source):
+            return True
+        if re.match('linux-riscv.*$', source):
+            # linux-riscv.* currently causes a lot of false positives, skip
+            # it altogether while we don't land a better fix
+            return True
+        return False
 
-        # Add package definition
-        definitions = root_element.find("definitions")
-        definition_element = self._generate_definition_element(package)
 
-        # Control/cache variables
-        one_time_added_id = None
-        fixed_versions = {}
-        binaries_id = None
-        cve_added = False
+class OvalGeneratorPkg(OvalGenerator):
+    def __init__(self, releases, cve_paths, packages, progress, pkg_cache, fixed_only=True, cve_cache=None,  cve_prefix_dir=None, outdir='./', oval_format='dpkg') -> None:
+        super().__init__('pkg', releases, cve_paths, packages, progress, pkg_cache, fixed_only, cve_cache,  cve_prefix_dir, outdir, oval_format)
 
-        #criteria = None
-        #if len(package.binaries) > 1:
-        #    criteria = self._generate_subcriteria('AND')
+    def _generate_advisory(self, package: Package) -> etree.Element:
+        advisory = etree.Element("advisory")
+        rights = etree.SubElement(advisory, "rights")
+        component = etree.SubElement(advisory, "component")
+        version = etree.SubElement(advisory, "current_version")
 
         for cve in package.cves:
-            pkg_rel_entry = cve.pkg_rel_entries[package.name]
-            for key in sorted(list(package.binaries)):
-                binaries = package.binaries[key]
-                if pkg_rel_entry.fixed_version:
-                    if pkg_rel_entry.fixed_version in fixed_versions:
-                        self._add_test_ref_to_cve_tag(fixed_versions[pkg_rel_entry.fixed_version], cve, definition_element)
-                        self._add_criterion(fixed_versions[pkg_rel_entry.fixed_version], pkg_rel_entry, cve, definition_element)
-                        continue
-                    else:
-                        self._add_test_ref_to_cve_tag(self.definition_id, cve, definition_element)
-                        self._add_criterion(self.definition_id, pkg_rel_entry, cve, definition_element)
-                        fixed_versions[pkg_rel_entry.fixed_version] = self.definition_id
-                elif one_time_added_id:
-                    self._add_test_ref_to_cve_tag(one_time_added_id, cve, definition_element)
-                    self._add_criterion(one_time_added_id, pkg_rel_entry, cve, definition_element)
-                    continue
-                else:
-                    self._add_test_ref_to_cve_tag(self.definition_id, cve, definition_element)
-                    self._add_criterion(self.definition_id, pkg_rel_entry, cve, definition_element)
-                    one_time_added_id = self.definition_id
+            if self.fixed_only and cve.pkg_rel_entries[str(package)].status != 'fixed':
+                continue
+            elif cve.pkg_rel_entries[str(package)].is_not_applicable():
+                continue
+            cve_obj = self._generate_cve_tag(cve)
+            advisory.append(cve_obj)
 
-                test, obj, var, state = self._generate_elements(package, binaries, pkg_rel_entry, binaries_id)
+        rights.text = f"Copyright (C) {datetime.now().year} Canonical Ltd."
+        component.text = package.section
+        version.text = package.get_latest_version()
+
+        return advisory
+
+    def _generate_metadata(self, package: Package) -> etree.Element:
+        metadata = etree.Element("metadata")
+        title = etree.SubElement(metadata, "title")
+        reference = self._generate_reference(package)
+        advisory = self._generate_advisory(package)
+        metadata.append(reference)
+        description = etree.SubElement(metadata, "description")
+        affected = etree.SubElement(metadata, "affected", attrib = {"family": "unix"})
+        platform = etree.SubElement(affected, "platform")
+        metadata.append(advisory)
+
+        platform.text = self.release_name
+        title.text = package.name
+        description.text = package.description
+
+        return metadata
+
+    # Element generators
+    def _generate_reference(self, package) -> etree.Element:
+        reference = etree.Element("reference", attrib={
+            "source": "Package",
+            "ref_id": package.name,
+            "ref_url": f'https://launchpad.net/ubuntu/+source/{package.name}'
+        })
+
+        return reference
+
+    def _populate_pkg(self, package, root_element):
+        tests = root_element.find("tests")
+        objects = root_element.find("objects")
+        variables = root_element.find("variables")
+        states = root_element.find("states")
+
+        # Add package definition
+        definitions = root_element.find("definitions")
+        definition_element = self._generate_definition_object(package)
+
+        # Control/cache variables
+        one_time_added_id = None
+        fixed_versions = {}
+        binaries_ids = {}
+        cve_added = False
+
+        #criteria = None
+        #if len(package.binaries) > 1:
+        #    criteria = self._generate_subcriteria('AND')
+
+        for cve in package.cves:
+            if self.fixed_only and cve.pkg_rel_entries[str(package)].status != 'fixed':
+                continue
+            pkg_rel_entry = cve.pkg_rel_entries[str(package)]
+            if pkg_rel_entry.is_not_applicable(): continue
+            source_version = package.get_version_to_check(pkg_rel_entry.fixed_version)
+            for binary_version in package.get_binary_versions(source_version):
+                binaries = package.get_binaries(source_version, binary_version)
+
+                # For released / not affected (version) CVEs
+                if pkg_rel_entry.fixed_version:
+                    if binary_version in fixed_versions:
+                        self._add_test_ref_to_cve_tag(fixed_versions[binary_version], cve, definition_element)
+                        self._add_criterion(fixed_versions[binary_version], pkg_rel_entry, cve, definition_element)
+                        continue
+                    else:
+                        self._add_test_ref_to_cve_tag(self.definition_id, cve, definition_element)
+                        self._add_criterion(self.definition_id, pkg_rel_entry, cve, definition_element)
+                        fixed_versions[binary_version] = self.definition_id
+                # For not fixed CVEs, we already added one for this package
+                elif one_time_added_id:
+                    self._add_test_ref_to_cve_tag(one_time_added_id, cve, definition_element)
+                    self._add_criterion(one_time_added_id, pkg_rel_entry, cve, definition_element)
+                    continue
+                # For not fixed CVEs, only need to add it once per package
+                else:
+                    self._add_test_ref_to_cve_tag(self.definition_id, cve, definition_element)
+                    self._add_criterion(self.definition_id, pkg_rel_entry, cve, definition_element)
+                    one_time_added_id = self.definition_id
+
+                # If version doesn't exist and only one binary_version, they all have the same binaries
+                if not package.version_exists(source_version) and package.all_binaries_same_version:
+                    binary_id_version = GENERIC_VERSION
+                else:
+                    binary_id_version = binary_version
+
+                binaries_ids.setdefault(binary_id_version, None)
+                binaries_id = binaries_ids[binary_id_version]  
+                test, obj, var, state = self._generate_elements(package, binaries, binary_version, pkg_rel_entry, binaries_id)
 
                 if state:
                     states.append(state)
 
                 if obj and var:
-                    binaries_id = self.definition_id
+                    binaries_ids[binary_id_version] = self.definition_id
                     variables.append(var)
                     objects.append(obj)
 
@@ -1099,29 +1376,39 @@ class OvalGeneratorPkg(OvalGenerator):
 
         self._increase_id(is_definition=True)
 
-    def _populate_kernel_pkg(self, package, root_element, running_kernel_id):
+    def _populate_kernel_pkg(self, package, root_element, running_kernel_id):            
+        for cve in package.cves:
+            pkg_rel_entry = cve.pkg_rel_entries[str(package)]
+            version_to_check = package.get_version_to_check(pkg_rel_entry.fixed_version)
+            for binary_version in package.get_binary_versions(version_to_check):
+                binaries = package.get_binaries(version_to_check, binary_version)
         # Add package definition
         definitions = root_element.find("definitions")
-        definition_element = self._generate_definition_element(package)
+        definition_element = self._generate_definition_object(package)
 
         # Control/cache variables
         fixed_versions = {}
         cve_added = False
 
+        # Kernel binaries have all same version
+        version = package.get_latest_version()
+        binaries = package.get_binaries(version, version)
+
         # Generate one-time elements
-        kernel_criterion = self._generate_kernel_package_elements(package, root_element, running_kernel_id)
-        criteria = self._generate_subcriteria('OR')
+        kernel_criterion = self._generate_kernel_package_elements(package, binaries, root_element, running_kernel_id)
+        criteria = self._generate_criteria_kernel('OR')
 
         self._add_to_criteria(definition_element, kernel_criterion, operator='AND')
         self._add_to_criteria(definition_element, criteria, operator='AND')
 
         for cve in package.cves:
-            pkg_rel_entry = cve.pkg_rel_entries[package.name]
+            pkg_rel_entry = cve.pkg_rel_entries[str(package)]
+            if pkg_rel_entry.is_not_applicable(): continue
             cve_added = True
 
             self._add_test_ref_to_cve_tag(self.definition_id, cve, definition_element)
 
-            kernel_version_criterion = self._add_fixed_kernel_elements(cve, package, pkg_rel_entry, root_element, running_kernel_id, fixed_versions)
+            kernel_version_criterion = self._add_kernel_elements(cve, package, pkg_rel_entry.fixed_version, pkg_rel_entry, root_element, running_kernel_id, fixed_versions)
             self._add_to_criteria(definition_element, kernel_version_criterion, depth=3)
             self._increase_id(is_definition=False)
 
@@ -1129,881 +1416,447 @@ class OvalGeneratorPkg(OvalGenerator):
             definitions.append(definition_element)
         self._increase_id(is_definition=True)
 
-    def _add_new_package(self, package_name, cve, release, cve_data, packages) -> None:
-        if package_name not in packages:
-            _, version, binaries = get_binarypkgs(self.pkg_cache, package_name, release)
-
-            pkg_obj = Package(package_name, release, binaries, version)
-            packages[package_name] = pkg_obj
-
-        pkg_obj = packages[package_name]
-        cve_pkg_entry = CVEPkgRelEntry(pkg_obj, release, cve, cve_data['pkgs'][package_name][release][0], cve_data['pkgs'][package_name][release][1], self.pkg_cache)
-
-        if cve_pkg_entry.status != 'fixed' and self.fixed_only:
-            return
-
-        cve.add_pkg(pkg_obj, cve_pkg_entry)
-
-    def _load_pkgs(self, cve_prefix_dir, packages_filter=None) -> None:
-        cve_lib.load_external_subprojects()
-
-        cves = []
-        for pathname in self.cve_paths:
-            cves = cves + glob.glob(os.path.join(cve_prefix_dir, pathname))
-
-        cves.sort(key=lambda cve:
-                   (int(cve.split('/')[-1].split('-')[1]), int(cve.split('/')[-1].split('-')[2])) \
-                    if cve.split('/')[-1].split('-')[2].isnumeric() \
-                    else (int(cve.split('/')[-1].split('-')[1]), 0)
-                 )
-
-        packages = {}
-        releases = [self.release]
-        current_release = self.release
-        while(cve_lib.release_parent(current_release)):
-            current_release = cve_lib.release_parent(current_release)
-            releases.append(current_release)
-
-        for release in releases:
-            sources[release] = load(releases=[release], skip_eol_releases=False)[release]
-
-            orig_name = cve_lib.get_orig_rel_name(release)
-            if '/' in orig_name:
-                orig_name = orig_name.split('/', maxsplit=1)[1]
-            source_map_binaries[release] = load(data_type='packages',releases=[orig_name], skip_eol_releases=False)[orig_name] \
-                if release not in cve_lib.external_releases else {}
-
-        i = 0
-        for cve_path in cves:
-            cve_number = cve_path.rsplit('/', 1)[1]
-            i += 1
-
-            if self.progress:
-                print(f'[{i:5}/{len(cves)}] Processing {cve_number:18}', end='\r')
-
-            if not cve_number in self.cve_cache:
-                self.cve_cache[cve_number] = cve_lib.load_cve(cve_path)
-
-            info = self.cve_cache[cve_number]
-            cve_obj = CVE(cve_number, info)
-
-            for pkg in info['pkgs']:
-                if packages_filter and pkg not in packages_filter:
-                    continue
-
-                for release in releases:
-                    if pkg in sources[release] and release in info['pkgs'][pkg] and \
-                        info['pkgs'][pkg][release][0] != 'DNE':
-                            self._add_new_package(pkg, cve_obj, release, info, packages)
-                            break
-
-        packages = dict(sorted(packages.items()))
-        if self.progress:
-            print(' ' * 40, end='\r')
-        return packages
-
     def generate_oval(self) -> None:
-        self._reset()
-        xml_tree, root_element = self._get_root_element("Package")
-        self._add_structure(root_element)
+        for release in self.releases:
+            self._init_ids(release)
+            xml_tree, root_element = self._get_root_element()
+            generator = self._get_generator("Package")
+            root_element.append(generator)
+            self._add_structure(root_element)
 
-        if self.oval_format == 'dpkg':
-            # One time kernel check
-            self._add_release_checks(root_element)
-            self._add_running_kernel_checks(root_element)
-            running_kernel_id = self.definition_id
-            self._increase_id(is_definition=True)
+            if self.oval_format == 'dpkg':
+                # One time kernel check
+                self._add_release_checks(root_element)
+                self._add_running_kernel_checks(root_element)
+                running_kernel_id = self.definition_id
+                self._increase_id(is_definition=True)
+
+            all_pkgs = dict()
+            for parent_release in list(self.parent_releases)[::-1]:
+                all_pkgs.update(self.packages[parent_release])
+            
+            all_pkgs.update(self.packages[self.release])
+
+            for pkg in all_pkgs:
+                if self._ignore_source_package(pkg): continue
+                if not all_pkgs[pkg].versions_binaries: continue
+                if not all_pkgs[pkg].get_binary_versions(next(iter(all_pkgs[pkg].versions_binaries))): continue
+                if all_pkgs[pkg].is_kernel_pkg and self.oval_format != 'oci':
+                    self._populate_kernel_pkg(all_pkgs[pkg], root_element, running_kernel_id)
+                else:
+                    self._populate_pkg(all_pkgs[pkg], root_element)
 
-        for pkg in self.packages:
-            if len(self.packages[pkg].binaries) == 0:
-                continue
+            self._write_oval_xml(xml_tree, root_element)
 
-            if is_kernel_binaries(self.packages[pkg].binaries) and self.oval_format != 'oci':
-                self._populate_kernel_pkg(self.packages[pkg], root_element, running_kernel_id)
-            else:
-                self._populate_pkg(self.packages[pkg], root_element)
+class OvalGeneratorCVE(OvalGenerator):
+    def __init__(self, releases, cve_paths, packages, progress, pkg_cache, fixed_only=True, cve_cache=None,  cve_prefix_dir=None, outdir='./', oval_format='dpkg') -> None:
+        super().__init__('cve', releases, cve_paths, packages, progress, pkg_cache, fixed_only, cve_cache,  cve_prefix_dir, outdir, oval_format)
 
-        #etree.indent(xml_tree, level=0) -> only available from Python 3.9
-        xmlstr = minidom.parseString(etree.tostring(root_element)).toprettyxml(indent="  ")
+    # For CVE OVAL, the definition ID is generated
+    # from the CVE ID
+    def _set_definition_id(self, cve_id):
+        self.definition_id = int(re.sub('[^0-9]', '', cve_id)) * self.definition_step
 
-        with open(os.path.join(self.output_dir, self.output_filepath), 'w') as file:
-            file.write(xmlstr)
-        #xml_tree.write(os.path.join(self.output_dir, self.output_filepath))
-        return
+    def _generate_advisory(self, cve: CVE) -> etree.Element:
+        advisory = etree.Element("advisory")
+        severity = etree.SubElement(advisory, "severity")
+        rights = etree.SubElement(advisory, "rights")
+        public_date = etree.SubElement(advisory, "public_date")
 
-class OvalGeneratorCVE:
-    supported_oval_elements = ('definition', 'test', 'object', 'state',
-                               'variable')
-    generator_version = '1.1'
-    oval_schema_version = '5.11.1'
+        if cve.public_date_at_usn:
+            public_date_at_usn = etree.SubElement(advisory, "public_date_at_usn")
+            public_date_at_usn.text = cve.public_date_at_usn
 
-    def __init__(self, release, release_name, parent, warn_method=False, outdir='./', prefix='', oval_format='dpkg'):
-        """ constructor, set defaults for instances """
+        if cve.assigned_to:
+            assigned_to = etree.SubElement(advisory, "assigned_to")
+            assigned_to.text = cve.assigned_to
+            
+        if cve.discoverd_by:
+            discoverd_by = etree.SubElement(advisory, "discoverd_by")
+            discoverd_by.text = cve.discoverd_by
 
-        self.release = release
-        # e.g. codename for trusty/esm should be trusty
-        self.release_codename = cve_lib.release_progenitor(release) if cve_lib.release_progenitor(release) else self.release.replace('/', '_')
-        self.release_name = release_name
-        self.warn = warn_method or self.warn
-        self.tmpdir = tempfile.mkdtemp(prefix='oval_lib-')
-        self.output_dir = outdir
-        self.oval_format = oval_format
-        self.output_filepath = \
-            '{0}com.ubuntu.{1}.cve.oval.xml'.format(prefix, self.release.replace('/', '_'))
-        self.ns = 'oval:com.ubuntu.{0}'.format(self.release_codename)
-        self.id = 10
-        self.release_applicability_definition_id = '{0}:def:{1}0'.format(self.ns, self.id)
+        for bug in cve.bugs:
+            element = etree.SubElement(advisory, 'bug')
+            element.text = bug
 
-    def __del__(self):
-        """ deconstructor, clean up """
-        if os.path.exists(self.tmpdir):
-            recursive_rm(self.tmpdir)
-
-    def generate_cve_definition(self, cve):
-        """ generate an OVAL definition based on parsed CVE data """
-
-        header = cve['header']
-        # if the multiplier is not large enough, the tests IDs will
-        # overlap on things with large numbers of binary packages.
-        # if we ever have an issue that touches more than 1,000,000
-        # binary packages, that will cause a problem.
-        id_base = int(re.sub('[^0-9]', '', header['Candidate'])) * 1000000
-        if not self.unique_id_base(id_base, header['Source-note']):
-            self.warn('Calculated id_base "{0}" based on candidate value "{1}" is not unique. Skipping CVE.'.format(id_base, header['Candidate']))
-
-        instruction = ""
-        # make test(s) for each package
-        test_refs = []
-        packages = cve['packages']
-        for package in sorted(packages.keys()):
-            if self.release in packages[package]['Releases']:
-                release_status = packages[package]['Releases'][self.release]
-                if 'bin-pkgs' in release_status and release_status['bin-pkgs']:
-                    for key in sorted(list(release_status['bin-pkgs'])):
-                        pkg = {
-                            'name': package,
-                            'binaries': release_status['bin-pkgs'][key],
-                            'status': release_status['status'],
-                            'note': release_status['note'],
-                            'fix-version': release_status['fix-version'] if 'fix-version' in release_status else '',
-                            'id_base': id_base + len(test_refs),
-                            'source-note': header['Source-note']
-                        }
-                        if is_kernel_binaries(pkg['binaries']):
-                            test_ref = self.get_running_kernel_testref(pkg)
-                            if test_ref:
-                                test_refs = test_refs + test_ref
-                                pkg['id_base'] = id_base + 1
-                        else:
-                            test_ref = self.get_oval_test_for_package(pkg)
-                            if test_ref:
-                                test_refs.append(test_ref)
-                        # prepare update instructions if package is fixed
-                        if pkg['status'] == 'fixed':
-                            if 'parent' in release_status:
-                                product_description = cve_lib.get_subproject_description(release_status['parent'])
-                            else:
-                                product_description = cve_lib.get_subproject_description(self.release)
-                            instruction = prepare_instructions(instruction, header['Candidate'], product_description, pkg)
-
-
-
-        # if no packages for this release, then we're done
-        if not len(test_refs):
-            return False
-
-        # convert CVE data to OVAL definition metadata
-        mapping = {
-            'ns': escape(self.ns),
-            'id_base': id_base,
-            'codename': escape(self.release_codename),
-            'release_name': escape(self.release_name),
-            'applicability_def_id': escape(
-                self.release_applicability_definition_id),
-            'cve_title': escape(header['Candidate']),
-            'description': escape('{0} {1}'.format(header['Description'],
-                                  header['Ubuntu-Description']).strip() + instruction),
-            'priority': escape(header['Priority']),
-            'criteria': '',
-            'references': '',
-            'notes': ''
-        }
+        for usn in cve.usns:
+            element = etree.SubElement(advisory, 'ref')
+            element.text = f'https://ubuntu.com/security/notices/USN-{usn}'
 
-        # convert test_refs to criteria
-        if len(test_refs) == 1:
-            negation_attribute = 'negate = "true" ' \
-                if 'negate' in test_refs[0] and test_refs[0]['negate'] else ''
-            mapping['criteria'] = \
-                '<criterion test_ref="{0}" comment="{1}" {2}/>'.format(
-                    test_refs[0]['id'], escape(test_refs[0]['comment']), negation_attribute)
-        else:
-            criteria = []
-            criteria.append('<criteria operator="OR">')
-            for test_ref in test_refs:
-                if 'kernel' in test_ref:
-                    criteria.append('    <criteria operator="AND">')
-                    negation_attribute = 'negate = "true" ' \
-                        if 'negate' in test_ref and test_ref['negate'] else ''
-                    criteria.append(
-                        '        <criterion test_ref="{0}" comment="{1}" {2}/>'.format(
-                            test_ref['id'],
-                            escape(test_ref['comment']), negation_attribute))
-                elif 'kernelobj' in test_ref:
-                    criteria.append(
-                        '        <criterion test_ref="{0}" comment="{1}" {2}/>'.format(
-                            test_ref['id'],
-                            escape(test_ref['comment']), negation_attribute))
-                    criteria.append('    </criteria>')
-                else:
-                    negation_attribute = 'negate = "true" ' \
-                        if 'negate' in test_ref and test_ref['negate'] else ''
-                    criteria.append(
-                        '    <criterion test_ref="{0}" comment="{1}" {2}/>'.format(
-                            test_ref['id'],
-                            escape(test_ref['comment']), negation_attribute))
-            criteria.append('</criteria>')
-            mapping['criteria'] = '\n                    '.join(criteria)
-
-        # convert notes
-        if header['Notes']:
-            mapping['notes'] = '\n                <oval:notes>' + \
-                               '\n                    <oval:note>{0}</oval:note>'.format(escape(header['Notes'])) + \
-                               '\n                </oval:notes>'
-
-        # convert additional data <advisory> metadata elements
-        advisory = []
-        advisory.append('<severity>{0}</severity>'.format(
-            escape(header['Priority'].title())))
-        advisory.append(
-            '<rights>Copyright (C) {0}Canonical Ltd.</rights>'.format(escape(
-                header['PublicDate'].split('-', 1)[0] + ' '
-                if header['PublicDate'] else '')))
-        if header['PublicDate']:
-            advisory.append('<public_date>{0}</public_date>'.format(
-                escape(header['PublicDate'])))
-        if header['PublicDateAtUSN']:
-            advisory.append(
-                '<public_date_at_usn>{0}</public_date_at_usn>'.format(escape(
-                    header['PublicDateAtUSN'])))
-        if header['Assigned-to']:
-            advisory.append('<assigned_to>{0}</assigned_to>'.format(escape(
-                header['Assigned-to'])))
-        if header['Discovered-by']:
-            advisory.append('<discovered_by>{0}</discovered_by>'.format(escape(
-                header['Discovered-by'])))
-        if header['CRD']:
-            advisory.append('<crd>{0}</crd>'.format(escape(header['CRD'])))
-        for bug in header['Bugs']:
-            advisory.append('<bug>{0}</bug>'.format(escape(bug)))
-        for ref in header['References']:
-            if ref.startswith('https://cve.mitre'):
-                cve_title = ref.split('=')[-1].strip()
-                if not cve_title:
-                    continue
-                mapping['cve_title'] = escape(cve_title)
-                mapping['references'] = '\n                    <reference source="CVE" ref_id="{0}" ref_url="{1}" />'.format(mapping['cve_title'], escape(ref))
+        advisory.append(self._generate_cve_tag(cve))
+        rights.text = f"Copyright (C) {cve.public_date.split('-', 1)[0]} Canonical Ltd."
+        severity.text = cve.priority.capitalize()
+        public_date.text = cve.public_date
 
-        cve_ref = generate_cve_tag(header)
-        advisory.append(cve_ref)
-        mapping['advisory_elements'] = '\n                        '.join(advisory)
+        return advisory
 
-        if self.oval_format == 'dpkg':
-            mapping['os_release_check'] = """<extend_definition definition_ref="{applicability_def_id}" comment="{release_name} ({codename}) is installed." applicability_check="true" />""".format(**mapping)
-        else:
-            mapping['os_release_check'] = ''
-
-        self.queue_element('definition', """
-            <definition class="vulnerability" id="{ns}:def:{id_base}0" version="1">
-                <metadata>
-                    <title>{cve_title} on {release_name} ({codename}) - {priority}.</title>
-                    <description>{description}</description>
-                    <affected family="unix">
-                        <platform>{release_name}</platform>
-                    </affected>{references}
-                    <advisory>
-                        {advisory_elements}
-                    </advisory>
-                </metadata>{notes}
-                <criteria>
-                    {os_release_check}
-                    {criteria}
-                </criteria>
-            </definition>\n""".format(**mapping))
+    def _generate_metadata(self, cve: CVE) -> etree.Element:
+        metadata = etree.Element("metadata")
+        title = etree.SubElement(metadata, "title")
+        reference = self._generate_reference(cve)
+        advisory = self._generate_advisory(cve)
+        description = etree.SubElement(metadata, "description")
+        affected = etree.SubElement(metadata, "affected", attrib = {"family": "unix"})
+        platform = etree.SubElement(affected, "platform")
+        metadata.append(reference)
+        metadata.append(advisory)
 
-    # TODO: xml lib
-    def add_release_applicability_definition(self):
-        """ add platform/release applicability OVAL definition for codename """
+        platform.text = self.release_name
+        title.text = f'{cve.number} on {self.release_name} ({self.release_codename}) - {cve.priority}'
+        description.text = cve.description.replace('\n','')
 
-        mapping = {
-            'ns': self.ns,
-            'id_base': self.id,
-            'codename': self.release_codename,
-            'release_name': self.release_name,
-        }
-        self.release_applicability_definition_id = \
-            '{ns}:def:{id_base}0'.format(**mapping)
+        return metadata
 
-        if self.oval_format == 'dpkg':
-            self.queue_element('definition', """
-                <definition class="inventory" id="{ns}:def:{id_base}0" version="1">
-                    <metadata>
-                        <title>Check that {release_name} ({codename}) is installed.</title>
-                        <description></description>
-                    </metadata>
-                    <criteria>
-                        <criterion test_ref="{ns}:tst:{id_base}0" comment="The host is part of the unix family." />
-                        <criterion test_ref="{ns}:tst:{id_base}1" comment="The host is running Ubuntu {codename}." />
-                    </criteria>
-                </definition>\n""".format(**mapping))
-
-            self.queue_element('test', """
-                <ind-def:family_test id="{ns}:tst:{id_base}0" check="at least one" check_existence="at_least_one_exists" version="1" comment="Is the host part of the unix family?">
-                    <ind-def:object object_ref="{ns}:obj:{id_base}0"/>
-                    <ind-def:state state_ref="{ns}:ste:{id_base}0"/>
-                </ind-def:family_test>
-
-                <ind-def:textfilecontent54_test id="{ns}:tst:{id_base}1" check="at least one" check_existence="at_least_one_exists" version="1" comment="Is the host running Ubuntu {codename}?">
-                    <ind-def:object object_ref="{ns}:obj:{id_base}1"/>
-                    <ind-def:state state_ref="{ns}:ste:{id_base}1"/>
-                </ind-def:textfilecontent54_test>\n""".format(**mapping))
-
-            # /etc/lsb-release has to be a single path, due to some
-            # environments (namely snaps) not being allowed to list the
-            # content of /etc/
-            self.queue_element('object', """
-                <ind-def:family_object id="{ns}:obj:{id_base}0" version="1" comment="The singleton family object."/>
-
-                <ind-def:textfilecontent54_object id="{ns}:obj:{id_base}1" version="1" comment="The singleton release codename object.">
-                    <ind-def:filepath>/etc/lsb-release</ind-def:filepath>
-                    <ind-def:pattern operation="pattern match">^[\\s\\S]*DISTRIB_CODENAME=([a-z]+)$</ind-def:pattern>
-                    <ind-def:instance datatype="int">1</ind-def:instance>
-                </ind-def:textfilecontent54_object>\n""".format(**mapping))
-
-            self.queue_element('state', """
-                <ind-def:family_state id="{ns}:ste:{id_base}0" version="1" comment="The singleton family object.">
-                    <ind-def:family>unix</ind-def:family>
-                </ind-def:family_state>
-
-                <ind-def:textfilecontent54_state id="{ns}:ste:{id_base}1" version="1" comment="{release_name}">
-                    <ind-def:subexpression>{codename}</ind-def:subexpression>
-                </ind-def:textfilecontent54_state>\n""".format(**mapping))
-
-    def get_oval_test_for_package(self, package):
-        """ create OVAL test and dependent objects for this package status
-                @package = {
-                    'name'          : '<package name>',
-                    'binaries'      : [ '<binary_pkg_name', '<binary_pkg_name', ... ],
-                    'status'        : '<not-applicable | unknown | vulnerable | fixed>',
-                    'note'          : '<a description of the status>',
-                    'fix-version'   : '<the version in which the issue was fixed, if applicable>',
-                    'id_base'       : a base for the integer section of the OVAL id,
-                    'source-note'   : a note about the datasource for debugging
-                }
-        """
+    # Element generators
+    def _generate_reference(self, cve: CVE) -> etree.Element:
+        reference = etree.Element("reference", attrib={
+            "source": "CVE",
+            "ref_id": cve.number,
+            "ref_url": f'https://cve.mitre.org/cgi-bin/cvename.cgi?name={cve.number}'
+        })
 
-        if package['status'] == 'fixed' and not package['fix-version']:
-            self.warn('"{0}" package in {1} is marked fixed, but missing a fix-version. Changing status to vulnerable.'.format(package['name'], package['source-note']))
-            package['status'] = 'vulnerable'
+        return reference        
 
-        if package['status'] == 'not-applicable':
-            # if the package status is not-applicable, skip it!
-            return False
-        elif package['status'] == 'not-vulnerable':
-            # if the packaget status is not-vulnerable, skip it!
-            return False
-            """
-            object_id = self.get_package_object_id(package['name'], package['id_base'], 1)
+    def prepare_instructions(self, instruction, cve: CVE, product_description, package: Package, fixed_version):
+        if "LSN" in cve.number:
+            instruction = """\n
+    To check your kernel type and Livepatch version, enter this command:
 
-            test_title = "Returns true whether or not the '{0}' package exists.".format(package['name'])
-            test_id = self.get_package_test_id(package['name'], package['id_base'], test_title, object_id, None, 1, 'any_exist')
+    canonical-livepatch status"""
 
-            package['note'] = package['name'] + package['note']
-            return {'id': test_id, 'comment': package['note'], 'negate': True}
-            """
-        elif package['status'] == 'vulnerable':
-            object_id = self.get_package_object_id(package['name'], package['binaries'], package['id_base'])
+        if not instruction:
+            instruction = """\n
+    Update Instructions:
 
-            test_title = "Does the '{0}' package exist?".format(package['name'])
-            test_id = self.get_package_test_id(package['name'], package['id_base'], test_title, object_id)
+    Run `sudo pro fix {0}` to fix the vulnerability. The problem can be corrected
+    by updating your system to the following package versions:""".format(cve)
 
-            package['note'] = package['name'] + package['note']
-            return {'id': test_id, 'comment': package['note']}
-        elif package['status'] == 'fixed':
-            object_id = self.get_package_object_id(package['name'], package['binaries'], package['id_base'])
+        instruction += '\n\n'
+        source_version = package.get_version_to_check(fixed_version)
+        for binary_version in package.get_binary_versions(source_version):
+            binaries = package.get_binaries(source_version, binary_version)
+            for binary in binaries:
+                instruction += """{0} - {1}\n""".format(binary, binary_version)
 
-            state_id = self.get_package_version_state_id(package['id_base'], package['fix-version'])
+        if "LSN" in cve.number:
+            instruction += "Livepatch subscription required"
+        elif "Long Term" in product_description or "Interim" in product_description:
+            instruction += "No subscription required"
+        else:
+            instruction += product_description
 
-            test_title = "Does the '{0}' package exist and is the version less than '{1}'?".format(package['name'], package['fix-version'])
-            test_id = self.get_package_test_id(package['name'], package['id_base'], test_title, object_id, state_id)
+        return instruction
 
-            package['note'] = package['name'] + package['note']
-            return {'id': test_id, 'comment': package['note']}
-        else:
-            if package['status'] != 'unknown':
-                self.warn('"{0}" is not a supported package status. Outputting for "unknown" status.'.format(package['status']))
+    def _populate_pkg(self, cve: CVE, package: Package, root_element, main_criteria, cache, fixed_versions) -> None:
+        tests = root_element.find("tests")
+        objects = root_element.find("objects")
+        variables = root_element.find("variables")
+        states = root_element.find("states")
+        pkg_rel_entry = cve.pkg_rel_entries[str(package)]
 
-            if not hasattr(self, 'id_unknown_test'):
-                self.id_unknown_test = '{0}:tst:10'.format(self.ns)
-                self.queue_element('test', """
-                    <ind-def:unknown_test id="{0}" check="all" comment="The result of this test is always UNKNOWN." version="1" />\n""".format(self.id_unknown_test))
+        source_version = package.get_version_to_check(pkg_rel_entry.fixed_version)
+        for binary_version in package.get_binary_versions(source_version):
+            binaries = package.get_binaries(source_version, binary_version)
+            cache_entry = f'{package.name}-{binary_version}'
 
-            package['note'] = package['name'] + package['note']
-            return {'id': self.id_unknown_test, 'comment': package['note']}
+            cache.setdefault(cache_entry, dict(bin_id=None, def_id=None))
 
-    # TODO: xml lib
-    def get_package_object_id(self, name, bin_pkgs, id_base, version=1):
-        """ create unique object for each package and return its OVAL id """
-        if not hasattr(self, 'package_objects'):
-            self.package_objects = {}
+            # If version doesn't exist and only one binary_version, they all have the same binaries
+            if not package.version_exists(source_version) and package.all_binaries_same_version:
+                cache_entry_bin = f'{package.name}-{GENERIC_VERSION}'
+                cache.setdefault(cache_entry_bin, dict(bin_id=None, def_id=None))
+            else:
+                cache_entry_bin = cache_entry
 
-        key = tuple(sorted(bin_pkgs))
+            if pkg_rel_entry.status == 'vulnerable' and not self.fixed_only:
+                if not cache_entry in cache or not cache[cache_entry]['def_id']:
+                    self._add_criterion(self.definition_id, pkg_rel_entry, cve, main_criteria)
 
-        if key not in self.package_objects:
-            object_id = '{0}:obj:{1}0'.format(self.ns, id_base)
+                    test, object, var = self._generate_vulnerable_elements(package, binaries, cache[cache_entry_bin]['bin_id'])
+                    tests.append(test)
 
-            if len(bin_pkgs) > 1:
-                # create variable for binary package names
-                variable_id = '{0}:var:{1}0'.format(self.ns, id_base)
-                if self.oval_format == 'dpkg':
-                    variable_values = '</value>\n                            <value>'.join(bin_pkgs)
-                    self.queue_element('variable', """
-                        <constant_variable id="{0}" version="{1}" datatype="string" comment="'{2}' package binaries">
-                            <value>{3}</value>
-                        </constant_variable>\n""".format(variable_id, version, name, variable_values))
-
-                    # create an object that references the variable
-                    self.queue_element('object', """
-                        <linux-def:dpkginfo_object id="{0}" version="{1}" comment="The '{2}' package binaries.">
-                            <linux-def:name var_ref="{3}" var_check="at least one" />
-                        </linux-def:dpkginfo_object>\n""".format(object_id, version, name, variable_id))
+                    if not cache[cache_entry_bin]['bin_id']:
+                        objects.append(object)
+                        variables.append(var)
+                        cache[cache_entry_bin]['bin_id'] = self.definition_id
 
+                    cache[cache_entry]['def_id'] = self.definition_id
+                    self._increase_id(is_definition=False)
                 else:
-                    variable_values = '(?::\w+|)\s+(.*)$</value>\n                            <value>^'.join(bin_pkgs)
-                    self.queue_element('variable', """
-                        <constant_variable id="{0}" version="{1}" datatype="string" comment="'{2}' package binaries">
-                            <value>^{3}(?::\w+|)\s+(.*)$</value>
-                        </constant_variable>\n""".format(variable_id, version, name, variable_values))
-
-                    # create an object that references the variable
-                    self.queue_element('object', """
-                        <ind-def:textfilecontent54_object id="{0}" version="{1}" comment="The '{2}' package binaries.">
-                            <ind-def:path>.</ind-def:path>
-                            <ind-def:filename>manifest</ind-def:filename>
-                            <ind-def:pattern operation="pattern match" datatype="string" var_ref="{3}" var_check="at least one" />
-                            <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
-                        </ind-def:textfilecontent54_object>\n""".format(object_id, version, name, variable_id))
-
-            else:
-                if self.oval_format == 'dpkg':
-                    # 1 binary package, so just use name in object (no variable)
-                    self.queue_element('object', """
-                        <linux-def:dpkginfo_object id="{0}" version="{1}" comment="The '{2}' package binary.">
-                            <linux-def:name>{3}</linux-def:name>
-                        </linux-def:dpkginfo_object>\n""".format(object_id, version, name, bin_pkgs[0]))
+                    self._add_criterion(cache[cache_entry]['def_id'], pkg_rel_entry, cve, main_criteria)
+            elif pkg_rel_entry.status == 'fixed':
+                if binary_version in fixed_versions:
+                    self._add_criterion(fixed_versions[binary_version], pkg_rel_entry, cve, main_criteria)
                 else:
-                    variable_id = '{0}:var:{1}0'.format(self.ns, id_base)
-                    variable_values = '(?::\w+|)\s+(.*)$</value>\n                            <value>^'.join(bin_pkgs)
-                    self.queue_element('variable', """
-                        <constant_variable id="{0}" version="{1}" datatype="string" comment="'{2}' package binaries">
-                            <value>^{3}(?::\w+|)\s+(.*)$</value>
-                        </constant_variable>\n""".format(variable_id, version, name, variable_values))
-                    self.queue_element('object', """
-                        <ind-def:textfilecontent54_object id="{0}" version="{1}" comment="The '{2}' package binary.">
-                            <ind-def:path>.</ind-def:path>
-                            <ind-def:filename>manifest</ind-def:filename>
-                            <ind-def:pattern operation="pattern match" datatype="string" var_ref="{3}" var_check="at least one" />
-                            <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
-                        </ind-def:textfilecontent54_object>\n""".format(object_id, version, name, variable_id))
-
-            self.package_objects[key] = object_id
-
-        return self.package_objects[key]
-
-    # TODO: xml lib
-    def get_package_version_state_id(self, id_base, fix_version, version=1):
-        """ create unique states for each version and return its OVAL id """
-        if not hasattr(self, 'package_version_states'):
-            self.package_version_states = {}
-
-        key = fix_version
-        if key not in self.package_version_states:
-            state_id = '{0}:ste:{1}0'.format(self.ns, id_base)
-            if self.oval_format == 'dpkg':
-                epoch_fix_version = fix_version if fix_version.find(':') != -1 else "0:" + fix_version
-                self.queue_element('state', """
-                    <linux-def:dpkginfo_state id="{0}" version="{1}" comment="The package version is less than '{2}'.">
-                        <linux-def:evr datatype="debian_evr_string" operation="less than">{2}</linux-def:evr>
-                    </linux-def:dpkginfo_state>\n""".format(state_id, version, epoch_fix_version))
-            else:
-                self.queue_element('state', """
-                    <ind-def:textfilecontent54_state id="{0}" version="{1}" comment="The package version is less than '{2}'.">
-                        <ind-def:subexpression datatype="debian_evr_string" operation="less than">{2}</ind-def:subexpression>
-                    </ind-def:textfilecontent54_state>\n""".format(state_id, version, fix_version))
-            self.package_version_states[key] = state_id
+                    self._add_criterion(self.definition_id, pkg_rel_entry, cve, main_criteria)
 
-        return self.package_version_states[key]
+                    test, object, var, state = self._generate_fixed_elements(package, binaries, binary_version, cache[cache_entry_bin]['bin_id'])
+                    tests.append(test)
+                    states.append(state)
 
-    # TODO: xml lib
-    def get_package_test_id(self, name, id_base, test_title, object_id, state_id=None, version=1, check_existence='at_least_one_exists'):
-        """ create unique test for each parameter set and return its OVAL id """
-        if not hasattr(self, 'package_tests'):
-            self.package_tests = {}
-
-        key = (name, test_title, object_id, state_id)
-        if key not in self.package_tests:
-            test_id = '{0}:tst:{1}0'.format(self.ns, id_base)
-            if self.oval_format == 'dpkg':
-                state_ref = '\n                        <linux-def:state state_ref="{0}" />'.format(state_id) if state_id else ''
-                self.queue_element('test', """
-                    <linux-def:dpkginfo_test id="{0}" version="{1}" check_existence="{5}" check="at least one" comment="{2}">
-                        <linux-def:object object_ref="{3}"/>{4}
-                    </linux-def:dpkginfo_test>\n""".format(test_id, version, test_title, object_id, state_ref, check_existence))
+                    if not cache[cache_entry_bin]['bin_id']:
+                        objects.append(object)
+                        variables.append(var)
+                        cache[cache_entry_bin]['bin_id'] = self.definition_id
+
+                    fixed_versions[binary_version] = self.definition_id
+                    self._increase_id(is_definition=False)
+
+    def _populate_kernel_pkg(self, cve: CVE, package: Package, root_element, main_criteria, running_kernel_id, cache, fixed_versions) -> None:
+        # Kernel binaries have all same version
+        version = package.get_latest_version()
+        binaries = package.get_binaries(version, version)
+        pkg_rel_entry = cve.pkg_rel_entries[str(package)]
+        cache_entry = f'{package.name}-{pkg_rel_entry.fixed_version}'
+
+        if not cache_entry in cache:
+            # Generate one-time elements
+            kernel_criterion = self._generate_kernel_package_elements(package, binaries, root_element, running_kernel_id)
+            cache[cache_entry] = kernel_criterion
+
+        if pkg_rel_entry.status == 'fixed':
+            criteria = self._generate_criteria_kernel('AND')
+            self._add_to_criteria(criteria, cache[cache_entry], operator='AND', depth=0)
+
+            kernel_version_criterion = self._add_kernel_elements(cve, package, pkg_rel_entry.fixed_version, pkg_rel_entry, root_element, running_kernel_id, fixed_versions)
+            self._add_to_criteria(criteria, kernel_version_criterion, depth=0)
+            self._add_to_criteria(main_criteria, criteria, depth=2, operator='OR')
+            self._increase_id(is_definition=False)
+        else:
+            self._add_to_criteria(main_criteria, cache[cache_entry], depth=2, operator='OR')
+
+    def _generate_elements_from_cve(self, cve, supported_releases, root_element, running_kernel_id, pkg_cache, fixed_versions) -> None:
+        if not cve.pkgs: return
+        added = False
+        definition_element = self._generate_definition_object(cve)
+        instructions = ''
+        pkgs = cve.get_pkgs(supported_releases)
+        for pkg in pkgs:
+            if not pkg.versions_binaries: continue
+            if not pkg.get_binary_versions(next(iter(pkg.versions_binaries))): continue
+            if self._ignore_source_package(pkg.name): continue
+
+            added = True                        
+            pkg_rel_entry = cve.pkg_rel_entries[str(pkg)]
+            if pkg.is_kernel_pkg and self.oval_format != 'oci':
+                self._populate_kernel_pkg(cve, pkg, root_element, definition_element, running_kernel_id, pkg_cache, fixed_versions)
             else:
-                state_ref = '\n                        <ind-def:state state_ref="{0}" />'.format(state_id) if state_id else ''
-                self.queue_element('test', """
-                    <ind-def:textfilecontent54_test id="{0}" version="{1}" check_existence="{5}" check="at least one" comment="{2}">
-                        <ind-def:object object_ref="{3}"/>{4}
-                    </ind-def:textfilecontent54_test>\n""".format(test_id, version, test_title, object_id, state_ref, check_existence))
-            self.package_tests[key] = test_id
-
-        return self.package_tests[key]
-
-    def get_running_kernel_testref(self, package):
-        if package['status'] == 'not-applicable':
-            # if the package status is not-applicable, skip it!
-            return
-        elif package['status'] == 'not-vulnerable':
-            # if the packaget status is not-vulnerable, skip it!
-            return
-
-        testref = []
-        uname_regex = process_kernel_binaries(package['binaries'], self.oval_format)
-        if uname_regex:
-            if self.oval_format == 'dpkg':
-                var_id = self.get_running_kernel_variable_id(
-                    uname_regex,
-                    package['id_base'])
-                ste_id = self.get_running_kernel_state_id(
-                    uname_regex,
-                    package['id_base'],
-                    var_id)
-                obj_id = self.get_running_kernel_object_id(
-                    package['id_base'])
-                test_id = self.get_running_kernel_test_id(
-                    uname_regex, package['id_base'], package['name'],
-                    obj_id, ste_id)
-                testref.append({'id': test_id,
-                                'comment': 'Is kernel {0} running'.format(package['name']),
-                                'kernel': uname_regex,
-                                'var_id': var_id,
-                                }
-                               )
-
-                # even if a cve was not fixed, we should add the test and object
-                # but not the state as there won't be a fixed version to compare
-                # with
-                ste_id = None
-                if package['fix-version']:
-                    ste_id = self.get_patched_kernel_state_id(
-                        package['id_base'],
-                        package['fix-version']
-                    )
-
-                obj_id = self.get_patched_kernel_object_id(package['id_base'],
-                                                           var_id)
-                test_id = self.get_patched_kernel_test_id(
-                    package['id_base'],
-                    package['fix-version'],
-                    obj_id, ste_id
-                )
-                testref.append({'id': test_id,
-                                'comment': 'kernel version comparison',
-                                'kernelobj': True})
-            else:  # OCI
-                object_id = self.get_package_object_id(package['name'],
-                                                       [uname_regex],
-                                                       package['id_base'])
-                state_id = None
-                test_title = "Does the '{0}' package exist?".format(package['name'])
-                if package['fix-version']:
-                    state_id = self.get_package_version_state_id(package['id_base'],
-                                                                 package['fix-version'])
-                    test_title = "Does the '{0}' package exist and is the version less than '{1}'?".format(package['name'],
-                                                                                                           package['fix-version'])
-                test_id = self.get_package_test_id(package['name'],
-                                                   package['id_base'],
-                                                   test_title,
-                                                   object_id,
-                                                   state_id)
-                package['note'] = package['name'] + package['note']
-                return [{'id': test_id, 'comment': package['note']}]
-
-        return testref
-
-    # TODO: xml lib
-    def get_running_kernel_object_id(self, id_base, version=1):
-        """ creates a uname_object so we can use the value from uname -r for
-            mainly two things:
-            1. compare with the return uname is of the same version and flavour
-               as the kernel we fixed a CVE. This is done in
-               get_running_kernel_state_id
-            2. store the uname value, minus the flavour, in a debian evr string
-               format, e.g: 0:5.4.0-1059. With this we can compare if the patched
-               kernel is greater than the running kernel
-            The result of this two will go through an AND logic to confirm
-            if we are or not vulnerable to such CVE"""
-        if not hasattr(self, 'kernel_uname_obj_id'):
-            self.kernel_uname_obj_id = None
-
-        if not self.kernel_uname_obj_id:
-            object_id = '{0}:obj:{1}0'.format(self.ns, id_base)
-
-            self.queue_element('object', """
-                    <unix-def:uname_object id="{0}" version="{1}"/>\n""".format(object_id, version))
-
-            self.kernel_uname_obj_id = object_id
-
-        return self.kernel_uname_obj_id
-
-    # TODO: xml lib
-    def get_running_kernel_state_id(self, uname_regex, id_base, var_id, version=1):
-        """ create uname_state to compare the system uname to the affected kernel
-            uname regex, allowing us to verify we are running the same major version
-            and flavour as the affected kernel.
-            Return its OVAL id
-        """
-        if not hasattr(self, 'uname_states'):
-            self.uname_states = {}
-
-        if uname_regex not in self.uname_states:
-            state_id = '{0}:ste:{1}0'.format(self.ns, id_base)
-            self.queue_element('state', """
-                    <unix-def:uname_state id="{0}" version="{1}">
-                        <unix-def:os_release operation="pattern match">{2}</unix-def:os_release>
-                    </unix-def:uname_state>\n""".format(state_id, version, uname_regex))
-
-            self.uname_states[uname_regex] = state_id
-
-        return self.uname_states[uname_regex]
-
-    # TODO: xml lib
-    def get_running_kernel_variable_id(self, uname_regex, id_base, version=1):
-        """ creates a local variable to store running kernel version in devian evr string"""
-        if not hasattr(self, 'uname_variables'):
-            self.uname_variables = {}
-
-            var_id = '{0}:var:{1}0'.format(self.ns, id_base)
-            obj_id = '{0}:obj:{1}0'.format(self.ns, id_base)
-            self.queue_element('variable', """
-                    <local_variable id="{0}" datatype="debian_evr_string" version="{1}" comment="kernel version in evr format">
-                        <concat>
-                            <literal_component>0:</literal_component>
-                            <regex_capture pattern="^([\d|\.]+-\d+)[-|\w]+$">
-                                <object_component object_ref="{2}" item_field="os_release" />
-                            </regex_capture>
-                        </concat>
-                    </local_variable>\n""".format(var_id, version, obj_id))
-
-            self.uname_variables['local_variable'] = var_id
-
-        return self.uname_variables['local_variable']
-
-    # TODO: xml lib
-    def get_running_kernel_test_id(self, uname_regex, id_base, name, object_id, state_id, version=1):
-        """ create uname test and return its OVAL id """
-        if not hasattr(self, 'uname_tests'):
-            self.uname_tests = {}
-
-        if uname_regex not in self.uname_tests:
-            test_id = '{0}:tst:{1}0'.format(self.ns, id_base)
-            self.queue_element('test', """
-                    <unix-def:uname_test check="at least one" comment="Is kernel {0} currently running?" id="{1}" version="{2}">
-                        <unix-def:object object_ref="{3}"/>
-                        <unix-def:state state_ref="{4}"/>
-                    </unix-def:uname_test>\n""".format(name, test_id, version, object_id, state_id))
-
-            self.uname_tests[uname_regex] = test_id
-
-        return self.uname_tests[uname_regex]
+                self._populate_pkg(cve, pkg, root_element, definition_element, pkg_cache, fixed_versions)
+            
+            if pkg_rel_entry.status == 'fixed' and pkg.versions_binaries:
+                product_description = cve_lib.get_subproject_description(pkg_rel_entry.release)
+                instructions = self.prepare_instructions(instructions, cve, product_description, pkg, pkg_rel_entry.fixed_version)
+        
+        if added:
+            definitions = root_element.find("definitions")
+            metadata = definition_element.find('metadata')
+            metadata.find('description').text = metadata.find('description').text + instructions
+            definitions.append(definition_element)
 
-    def get_patched_kernel_variable_id(self, id_base, fixed_version, version=1):
-        """ creates a local variable to store the patched kernel version """
-        if not hasattr(self, 'patched_kernel_variables'):
-            self.patched_kernel_variables = {}
 
-        patched = re.search('([\d|\.]+-\d+)[\.|\d]+', fixed_version)
-        if patched:
-            patched = patched.group(1)
-        else:
-            patched = fixed_version
-
-        if patched not in self.patched_kernel_variables:
-            var_id = '{0}:var:{1}0'.format(self.ns, id_base + 1)
+    def generate_oval(self) -> None:
+        for release in self.releases:
+            self._init_ids(release)
+            self.definition_step = 1 * 10 ** 7
+            xml_tree, root_element = self._get_root_element()
+            generator = self._get_generator("CVE")
+            root_element.append(generator)
+            self._add_structure(root_element)
+            running_kernel_id = None
 
-            self.queue_element('variable', """
-                 <constant_variable id="{0}" version="{1}" datatype="debian_evr_string" comment="patched kernel">
-                     <value>0:{2}</value>
-                 </constant_variable>""".format(var_id, version, patched))
+            if self.oval_format == 'dpkg':
+                # One time kernel check
+                self._add_release_checks(root_element)
+                self._add_running_kernel_checks(root_element)
+                running_kernel_id = self.definition_id
+
+            pkg_cache = {}
+            fixed_versions = {}
+            accepted_releases = list(self.parent_releases)
+            accepted_releases.insert(0, self.release)
+
+            all_cves = self.cves[self.release]
+            for parent_release in list(self.parent_releases):
+                for cve in self.cves[parent_release]:
+                    if cve not in all_cves:
+                        all_cves[cve] = self.cves[parent_release][cve]
+
+            all_cves = dict(sorted(all_cves.items()))
+
+            for cve in all_cves:
+                self._set_definition_id(cve_id=all_cves[cve].number)
+                self._generate_elements_from_cve(all_cves[cve], accepted_releases, root_element, running_kernel_id, pkg_cache, fixed_versions)
+
+            self._write_oval_xml(xml_tree, root_element)
+
+class OvalGeneratorUSNs(OvalGenerator):
+    def __init__(self, release, release_name, cve_paths, packages, progress, pkg_cache, usn_db_dir, fixed_only=True, cve_cache=None,  cve_prefix_dir=None, outdir='./', oval_format='dpkg') -> None:
+        super().__init__('usn', release, release_name, cve_paths, packages, progress, pkg_cache, fixed_only, cve_cache,  cve_prefix_dir, outdir, oval_format)
+        self._load_usns(usn_db_dir)
+
+    def _load_usns(self, usn_db_dir):
+        self.usns = {}
+        for filename in glob.glob(os.path.join(usn_db_dir, 'database*.json')):
+            with open(filename, 'r') as f:
+                data = json.load(f)
+                for item in data:
+                    usn = USN(item)
+                    self.usns[usn.id] = usn
+
+        for usn_id in sorted(self.usns.keys()):
+            if re.search(r'^[0-9]+-[0-9]$', usn_id):
+                self.usns[usn_id]['id'] = 'USN-' + usn_id
+
+    def _generate_advisory(self, usn: USN) -> etree.Element:
+        severities = ['low', 'medium', 'high', 'critical']
+        advisory = etree.Element("advisory")
+        severity = etree.SubElement(advisory, "severity")
+        issued = etree.SubElement(advisory, "issued")
+        severity = None
+        for cve in usn.cves:
+            cve_obj = self._generate_cve_tag(self.cves[cve])
+            advisory.append(cve_obj)
 
-            self.patched_kernel_variables[patched] = var_id
+            if not severity or severities.index(self.cves[cve].severity) > severities.index(severity):
+                severity = self.cves[cve].severity
 
-        return self.patched_kernel_variables[patched]
+        severity.text = severity.capitalize()
+        issued.text = usn.timestamp
 
-    def get_patched_kernel_object_id(self, id_base, var_id, version=1):
-        """ create variable object that points to kernel version
-            in evr format in local_variable
-        """
+        return advisory
 
-        object_id = '{0}:obj:{1}0'.format(self.ns, id_base + 1)
+    def _generate_metadata(self, usn: USN) -> etree.Element:
+        metadata = etree.Element("metadata")
+        title = etree.SubElement(metadata, "title")
+        description = etree.SubElement(metadata, "description")
+        affected = etree.SubElement(metadata, "affected", attrib = {"family": "unix"})
+        platform = etree.SubElement(affected, "platform")
 
-        self.queue_element('object', """
-                <ind-def:variable_object id="{0}" version="{1}">
-                    <ind-def:var_ref>{2}</ind-def:var_ref>
-                </ind-def:variable_object>\n""".format(object_id, version, var_id))
+        reference = self._generate_reference(usn)
+        metadata.append(reference)            
+        advisory = self._generate_advisory(usn)
+        metadata.append(reference)
+        metadata.append(advisory)
 
-        return object_id
+        platform.text = self.release_name
+        title.text = usn.title
+        description.text = usn.description
 
-    # TODO: xml lib
-    def get_patched_kernel_state_id(self, id_base, fixed_version, version=1):
-        """ create state to compare to the running kernel
-            Return its OVAL id
-        """
-        if not hasattr(self, 'patched_kernel_states'):
-            self.patched_kernel_states = {}
+        return metadata
 
-        patched = re.search('([\d|\.]+-\d+)[\.|\d]+', fixed_version)
-        if patched:
-            patched = patched.group(1)
-        else:
-            patched = fixed_version
+    # Element generators
+    def _generate_reference(self, usn: USN) -> etree.Element:
+        reference = etree.Element("reference", attrib={
+            "source": "USN",
+            "ref_id": usn.id,
+            "ref_url": f'https://ubuntu.com/security/notices/{usn.id}'
+        })
 
-        if patched not in self.patched_kernel_states:
-            state_id = '{0}:ste:{1}0'.format(self.ns, id_base + 1)
+        return reference
 
-            self.queue_element('state', """
-                    <ind-def:variable_state id="{0}" version="{1}">
-                        <ind-def:value datatype="debian_evr_string" operation="less than">{2}</ind-def:value>
-                    </ind-def:variable_state>\n""".format(state_id, version, patched))
+    def _populate_pkg(self, cve: CVE, package: Package, root_element, main_criteria, cache, fixed_versions) -> None:
+        tests = root_element.find("tests")
+        objects = root_element.find("objects")
+        variables = root_element.find("variables")
+        states = root_element.find("states")
+        pkg_rel_entry = cve.pkg_rel_entries[str(package)]
+        cache.setdefault(package.name, dict(bin_id=None, def_id=None))
 
-            self.patched_kernel_states[patched] = state_id
 
-        return self.patched_kernel_states[patched]
+        if pkg_rel_entry.status == 'vulnerable' and not self.fixed_only:
+            if not package.name in cache or not cache[package.name]['def_id']:
+                self._add_criterion(self.definition_id, pkg_rel_entry, cve, main_criteria)
 
-    def get_patched_kernel_test_id(self, id_base, fixed_version, object_id, state_id, version=1):
-        """ create patched kernel test and return its OVAL id """
-        if not hasattr(self, 'patched_kernel_tests'):
-            self.patched_kernel_tests = {}
+                test, object, var = self._generate_vulnerable_elements(package, cache[package.name]['bin_id'])
+                tests.append(test)
 
-        if fixed_version not in self.patched_kernel_tests:
-            test_id = '{0}:tst:{1}0'.format(self.ns, id_base + 1)
+                if not cache[package.name]['bin_id']:
+                    objects.append(object)
+                    variables.append(var)
+                    cache[package.name]['bin_id'] = self.definition_id
 
-            if state_id:
-                self.queue_element('test', """
-                <ind-def:variable_test id="{0}" version="1" check="all" check_existence="all_exist" comment="kernel version comparison">
-                    <ind-def:object object_ref="{1}"/>
-                    <ind-def:state state_ref="{2}"/>
-                </ind-def:variable_test>\n""".format(test_id, object_id, state_id))
+                cache[package.name]['def_id'] = self.definition_id
+                self._increase_id(is_definition=False)
             else:
-                self.queue_element('test', """
-                <ind-def:variable_test id="{0}" version="1" check="all" check_existence="all_exist" comment="kernel version comparison">
-                    <ind-def:object object_ref="{1}"/>
-                </ind-def:variable_test>\n""".format(test_id, object_id))
-
-            self.patched_kernel_tests[fixed_version] = test_id
-
-        return self.patched_kernel_tests[fixed_version]
-
-    def queue_element(self, element, xml):
-        """ add an OVAL element to an output queue file """
-        if element not in OvalGenerator.supported_oval_elements:
-            self.warn('"{0}" is not a supported OVAL element.'.format(element))
-            return
-
-        if not hasattr(self, 'tmp'):
-            self.tmp = {}
-            self.tmp_n = random.randrange(1000000, 9999999)
+                self._add_criterion(cache[package.name]['def_id'], pkg_rel_entry, cve, main_criteria)
+        elif pkg_rel_entry.status == 'fixed':
+            if pkg_rel_entry.fixed_version in fixed_versions:
+                self._add_criterion(fixed_versions[pkg_rel_entry.fixed_version], pkg_rel_entry, cve, main_criteria)
+            else:
+                self._add_criterion(self.definition_id, pkg_rel_entry, cve, main_criteria)
 
-        if element not in self.tmp:
-            self.tmp[element] = _open(os.path.join(self.tmpdir,
-                                           './queue.{0}.{1}.xml'.format(
-                                               self.tmp_n, element)), 'wt')
+                test, object, var, state = self._generate_fixed_elements(package, pkg_rel_entry, cache[package.name]['bin_id'])
+                tests.append(test)
+                states.append(state)
 
-        # trim and fix indenting (assumes fragment is nicely indented internally)
-        xml = xml.strip('\n')
-        base_indent = re.match(r'\s*', xml).group(0)
-        xml = re.sub('^{0}'.format(base_indent), '        ', xml, 0,
-                     re.MULTILINE)
+                if not cache[package.name]['bin_id']:
+                    objects.append(object)
+                    variables.append(var)
+                    cache[package.name]['bin_id'] = self.definition_id
 
-        self.tmp[element].write(xml + '\n')
+                fixed_versions[pkg_rel_entry.fixed_version] = self.definition_id
+                self._increase_id(is_definition=False)
 
-    # TODO: xml lib
-    def write_to_file(self):
-        """ dequeue all elements into one OVAL definitions file and clean up """
-        if not hasattr(self, 'tmp'):
-            return
+    def _populate_kernel_pkg(self, cve: CVE, package: Package, root_element, main_criteria, running_kernel_id, cache, fixed_versions) -> None:
+        if not package.name in cache:
+            # Generate one-time elements
+            kernel_criterion = self._generate_kernel_package_elements(package, root_element, running_kernel_id)
+            cache[package.name] = kernel_criterion
 
-        # close queue files for writing and then open for reading
-        for key in self.tmp:
-            self.tmp[key].close()
-            self.tmp[key] = _open(self.tmp[key].name, 'rt')
+        pkg_rel_entry = cve.pkg_rel_entries[str(package)]
 
-        tmp = os.path.join(self.tmpdir, self.output_filepath)
-        with _open(tmp, 'wt') as f:
-            # add header
-            oval_timestamp = datetime.now(tz=timezone.utc).strftime(
-                '%Y-%m-%dT%H:%M:%S')
-            f.write("""<oval_definitions
-    xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5"
-    xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent"
-    xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5"
-    xmlns:unix-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix"
-    xmlns:linux-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux"
-    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd   http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd   http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd   http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd   http://oval.mitre.org/XMLSchema/oval-definitions-5#macos linux-definitions-schema.xsd">
+        if pkg_rel_entry.status == 'fixed':
+            criteria = self._generate_criteria_kernel('AND')
+            self._add_to_criteria(criteria, cache[package.name], operator='AND', depth=0)
 
-    <generator>
-        <oval:product_name>Canonical CVE OVAL Generator</oval:product_name>
-        <oval:product_version>{0}</oval:product_version>
-        <oval:schema_version>{1}</oval:schema_version>
-        <oval:timestamp>{2}</oval:timestamp>
-    </generator>\n""".format(OvalGenerator.generator_version, OvalGenerator.oval_schema_version, oval_timestamp))
+            kernel_version_criterion = self._add_kernel_elements(cve, package, pkg_rel_entry, root_element, running_kernel_id, fixed_versions)
+            self._add_to_criteria(criteria, kernel_version_criterion, depth=0)
+            self._add_to_criteria(main_criteria, criteria, depth=2, operator='OR')
+            self._increase_id(is_definition=False)
+        else:
+            self._add_to_criteria(main_criteria, cache[package.name], depth=2, operator='OR')
+        
+        self._increase_id(is_definition=True)
 
-            # add queued file content
-            for element in OvalGenerator.supported_oval_elements:
-                if element in self.tmp:
-                    f.write("\n    <{0}s>\n".format(element))
-                    f.write(self.tmp[element].read().rstrip())
-                    f.write("\n    </{0}s>".format(element))
+    def generate_oval(self) -> None:
+        self._reset()
+        xml_tree, root_element = self._get_root_element()
+        generator = self._get_generator("USN")
+        root_element.append(generator)
+        self._add_structure(root_element)
 
-            # add footer
-            f.write("\n</oval_definitions>")
+        if self.oval_format == 'dpkg':
+            # One time kernel check
+            self._add_release_checks(root_element)
+            self._add_running_kernel_checks(root_element)
+            running_kernel_id = self.definition_id
+            self._increase_id(is_definition=True)
 
-        # close and delete queue files
-        for key in self.tmp:
-            self.tmp[key].close()
-            os.remove(self.tmp[key].name)
+        definitions = root_element.find("definitions")
+        pkg_cache = {}
+        fixed_versions = {}
 
-        # close self.output_filepath and move into place
-        f.close()
-        shutil.move(tmp, os.path.join(self.output_dir, self.output_filepath))
+        for usn in self.usns:
+            definition_element = self._generate_definition_object(self.usns[usn])
+            instructions = ''
 
-        # remove tmp dir if empty
-        if not os.listdir(self.tmpdir):
-            os.rmdir(self.tmpdir)
+            for cve in self.cves:
+                for pkg in self.cves[cve].pkgs:
+                    pkg_rel_entry = self.cves[cve].pkg_rel_entries[str(pkg)]
+                    if self.packages[pkg].is_kernel_pkg and self.oval_format != 'oci':
+                        self._populate_kernel_pkg(self.cves[cve], pkg, root_element, definition_element, running_kernel_id, pkg_cache, fixed_versions)
+                    else:
+                        self._populate_pkg(self.cves[cve], pkg, root_element, definition_element, pkg_cache, fixed_versions)
+                    
+                    if pkg_rel_entry.status == 'fixed' and pkg.binaries:
+                        product_description = cve_lib.get_subproject_description(pkg_rel_entry.release)
+                        instructions = prepare_instructions(instructions, self.cves[cve].number, product_description, {'binaries': pkg.binaries, 'fix-version': pkg_rel_entry.fixed_version})
+            
+            metadata = definition_element.find('metadata')
+            metadata.find('description').text = metadata.find('description').text + instructions
+            definitions.append(definition_element)
 
-    def unique_id_base(self, id_base, note):
-        """ queue a warning message """
-        if not hasattr(self, 'id_bases'):
-            self.id_bases = {}
-        is_unique = id_base not in self.id_bases.keys()
-        if not is_unique:
-            self.warn('ID Base collision {0} in {1} and {2}.'.format(
-                id_base, note, self.id_bases[id_base]))
-        self.id_bases[id_base] = note
-        return is_unique
-
-    def warn(self, message):
-        """ print a warning message """
-        print('WARNING: {0}'.format(message))
+        self._write_oval_xml(xml_tree, root_element)
 
 class OvalGeneratorUSN():
     supported_oval_elements = ('definition', 'test', 'object', 'state',
@@ -2709,7 +2562,7 @@ class OvalGeneratorUSN():
     xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5"
     xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix"
     xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux"
-    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd   http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd   http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd   http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd   http://oval.mitre.org/XMLSchema/oval-definitions-5#macos linux-definitions-schema.xsd">
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd   http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd   http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd   http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd   http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd">
 
     <generator>
         <oval:product_name>Canonical USN OVAL Generator</oval:product_name>
diff --git a/test/gold_oval_structure/oval.xml b/test/gold_oval_structure/oval.xml
index c45fd96..1600b15 100644
--- a/test/gold_oval_structure/oval.xml
+++ b/test/gold_oval_structure/oval.xml
@@ -4,7 +4,7 @@
     xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5"
     xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix"
     xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux"
-    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd   http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd   http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd   http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd   http://oval.mitre.org/XMLSchema/oval-definitions-5#macos linux-definitions-schema.xsd">
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd   http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd   http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd   http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd   http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd">
 
     <generator>
         <oval:product_name>Canonical USN OVAL Generator</oval:product_name>