Merge ~litios/ubuntu-cve-tracker:oval/fix_broken_criteria into ubuntu-cve-tracker:master

[David Fernandez Gonzalez]

This PR fixes several issues:

1. Prevent empty CVEs from being created when the affected packages have no valid binaries.

2. Properly set parent release priorities. A bug occurred where the status wasn't set correctly, making the results unpredictable.

3. Set the right version and status when there are parent releases involved.
   1. If the status is vulnerable, use the top release with the latest available binaries.
   2. If the status is fixed, find the parent in which it was fixed and use that.

[David Fernandez Gonzalez (litios)]

Diffs:

* Jammy: https://pastebin.canonical.com/p/NTjzD4Fkjj/ (None)
* Jammy OCI: https://pastebin.canonical.com/p/h5nvD5RWnP/ (None)
* Bionic: https://pastebin.canonical.com/p/NVXXRq7Hd3/ (Empty CVE gone)
* Bionic OCI: https://pastebin.canonical.com/p/r4jfy6nhnc/ (Emtpy CVE gone)
* ESM-apps Xenial: Too long for pastebin (Many esm-apps/xenial -> xenial, affects kernel too)
  - Results diff: (None)

[Eduardo Barretto (ebarretto)]

lgtm, thanks for handling/investigating this!

review: Approve

[Paulo Flabiano Smorigo (pfsmorigo)]

LGTM

review: Approve

diff --git a/scripts/oval_lib.py b/scripts/oval_lib.py
index f0c89fc..489200e 100644
--- a/scripts/oval_lib.py
+++ b/scripts/oval_lib.py
@@ -311,15 +311,24 @@ class CVE:
                 continue
             
             if pkg.name not in pkg_rel:
-                pkg_rel[pkg.name] = pkg.rel
-            elif releases.index(pkg.rel) < releases.index(pkg_rel[pkg.name]):
-                pkg_rel[pkg.name] = pkg.rel
-        
+                pkg_rel[pkg.name] = pkg
+            else:
+                pkg_rel_entry = self.pkg_rel_entries[str(pkg)]
+                curr_pkg_rel_entry = self.pkg_rel_entries[str(pkg_rel[pkg.name])]
+                if curr_pkg_rel_entry.status == 'fixed':
+                    priority = releases.index(pkg.rel) > releases.index(pkg_rel[pkg.name].rel) and \
+                        pkg_rel_entry.fixed_version in pkg.versions_binaries
+                else:
+                    priority = releases.index(pkg.rel) < releases.index(pkg_rel[pkg.name].rel)
+
+                if priority:
+                    pkg_rel[pkg.name] = pkg
+
         for pkg in self.pkgs:
             if self.pkg_rel_entries[str(pkg)].is_not_applicable():
                 continue
 
-            if pkg.name in pkg_rel and pkg_rel[pkg.name] == pkg.rel:
+            if pkg.name in pkg_rel and pkg_rel[pkg.name].rel == pkg.rel:
                 pkgs.append(pkg)
         
         return pkgs
@@ -433,11 +442,13 @@ class Package:
     def get_binaries(self, source_version, binary_version):
         if not self.versions_binaries: return {}
         if source_version not in self.versions_binaries:
-            if len(self.versions_binaries[self.earliest_version]) != 1:
-                print(f"WARN: Version {source_version} doesn't exist yet the package {self.name} has different versions for the binaries")
-
             version_binaries = self.versions_binaries[self.earliest_version]
-            return version_binaries[self.get_binary_versions(self.earliest_version)[0]]
+            if len(version_binaries) > 1:
+                print(f"WARN: Version {source_version} doesn't exist yet the package {self.name} has different versions for the binaries")
+            elif len(version_binaries) == 0:
+                return []
+            binary_versions = self.get_binary_versions(self.earliest_version)
+            return version_binaries[binary_versions[0]]
         return self.versions_binaries[source_version][binary_version]
 
     def __str__(self) -> str:
@@ -483,12 +494,13 @@ class OvalGenerator:
         self.release_codename = cve_lib.release_progenitor(self.release) if cve_lib.release_progenitor(self.release) else self.release.replace('/', '_')
         self.release_name = cve_lib.release_name(self.release)
         
-        self.parent_releases = set()
+        self.parent_releases = list()
         current_release = self.release
         while(cve_lib.release_parent(current_release)):
             current_release = cve_lib.release_parent(current_release)
-            if current_release != self.release:
-                self.parent_releases.add(current_release)
+            if current_release != self.release and \
+                current_release not in self.parent_releases:
+                self.parent_releases.append(current_release)
         
         self.ns = 'oval:com.ubuntu.{0}'.format(self.release_codename)
         self.id = 100
@@ -1441,7 +1453,7 @@ class OvalGeneratorPkg(OvalGenerator):
                 self._increase_id(is_definition=True)
 
             all_pkgs = dict()
-            for parent_release in list(self.parent_releases)[::-1]:
+            for parent_release in self.parent_releases[::-1]:
                 all_pkgs.update(self.packages[parent_release])
             
             all_pkgs.update(self.packages[self.release])
@@ -1556,16 +1568,18 @@ class OvalGeneratorCVE(OvalGenerator):
 
         return instruction
 
-    def _populate_pkg(self, cve: CVE, package: Package, root_element, main_criteria, cache, fixed_versions) -> None:
+    def _populate_pkg(self, cve: CVE, package: Package, root_element, main_criteria, cache, fixed_versions) -> bool:
         tests = root_element.find("tests")
         objects = root_element.find("objects")
         variables = root_element.find("variables")
         states = root_element.find("states")
         pkg_rel_entry = cve.pkg_rel_entries[str(package)]
+        added = False
 
         source_version = package.get_version_to_check(pkg_rel_entry.fixed_version)
         for binary_version in package.get_binary_versions(source_version):
             binaries = package.get_binaries(source_version, binary_version)
+            if not binaries: continue
             cache_entry = f'{package.name}-{binary_version}'
 
             cache.setdefault(cache_entry, dict(bin_id=None, def_id=None))
@@ -1578,6 +1592,7 @@ class OvalGeneratorCVE(OvalGenerator):
                 cache_entry_bin = cache_entry
 
             if pkg_rel_entry.status == 'vulnerable' and not self.fixed_only:
+                added = True
                 if not cache_entry in cache or not cache[cache_entry]['def_id']:
                     self._add_criterion(self.definition_id, pkg_rel_entry, cve, main_criteria)
 
@@ -1594,6 +1609,7 @@ class OvalGeneratorCVE(OvalGenerator):
                 else:
                     self._add_criterion(cache[cache_entry]['def_id'], pkg_rel_entry, cve, main_criteria)
             elif pkg_rel_entry.status == 'fixed':
+                added = True
                 if binary_version in fixed_versions:
                     self._add_criterion(fixed_versions[binary_version], pkg_rel_entry, cve, main_criteria)
                 else:
@@ -1611,6 +1627,8 @@ class OvalGeneratorCVE(OvalGenerator):
                     fixed_versions[binary_version] = self.definition_id
                     self._increase_id(is_definition=False)
 
+        return added
+
     def _populate_kernel_pkg(self, cve: CVE, package: Package, root_element, main_criteria, running_kernel_id, cache, fixed_versions) -> None:
         # Kernel binaries have all same version
         version = package.get_latest_version()
@@ -1636,27 +1654,29 @@ class OvalGeneratorCVE(OvalGenerator):
 
     def _generate_elements_from_cve(self, cve, supported_releases, root_element, running_kernel_id, pkg_cache, fixed_versions) -> None:
         if not cve.pkgs: return
-        added = False
+        cve_added = False
         definition_element = self._generate_definition_object(cve)
         instructions = ''
         pkgs = cve.get_pkgs(supported_releases)
         for pkg in pkgs:
+            pkg_added = False
             if not pkg.versions_binaries: continue
-            if not pkg.get_binary_versions(next(iter(pkg.versions_binaries))): continue
             if self._ignore_source_package(pkg.name): continue
 
-            added = True                        
             pkg_rel_entry = cve.pkg_rel_entries[str(pkg)]
             if pkg.is_kernel_pkg and self.oval_format != 'oci':
                 self._populate_kernel_pkg(cve, pkg, root_element, definition_element, running_kernel_id, pkg_cache, fixed_versions)
+                pkg_added = True
             else:
-                self._populate_pkg(cve, pkg, root_element, definition_element, pkg_cache, fixed_versions)
+                pkg_added = self._populate_pkg(cve, pkg, root_element, definition_element, pkg_cache, fixed_versions)
             
-            if pkg_rel_entry.status == 'fixed' and pkg.versions_binaries:
+            if pkg_rel_entry.status == 'fixed' and pkg_added:
                 product_description = cve_lib.get_subproject_description(pkg_rel_entry.release)
                 instructions = self.prepare_instructions(instructions, cve, product_description, pkg, pkg_rel_entry.fixed_version)
+
+            cve_added = cve_added | pkg_added
         
-        if added:
+        if cve_added:
             definitions = root_element.find("definitions")
             metadata = definition_element.find('metadata')
             metadata.find('description').text = metadata.find('description').text + instructions
@@ -1681,11 +1701,11 @@ class OvalGeneratorCVE(OvalGenerator):
 
             pkg_cache = {}
             fixed_versions = {}
-            accepted_releases = list(self.parent_releases)
+            accepted_releases = self.parent_releases.copy()
             accepted_releases.insert(0, self.release)
 
             all_cves = self.cves[self.release]
-            for parent_release in list(self.parent_releases):
+            for parent_release in self.parent_releases:
                 for cve in self.cves[parent_release]:
                     if cve not in all_cves:
                         all_cves[cve] = self.cves[parent_release][cve]