Merge ~pfsmorigo/ubuntu-cve-tracker:pfsmorigo/pocket_field_for_publish_cves into ubuntu-cve-tracker:master

[Paulo Flabiano Smorigo]

This commit adds the pocket field to the payload we send to the web api. More info in:
https://warthogs.atlassian.net/browse/SEC-1905

Basically checks if it's a product release and use the pocket for it, otherwise will be "security".

The field is already in place and working. I tested with one of our CVEs as you can see here:
https://ubuntu.com/security/cves/CVE-2023-28370.json

Also, more tests where added in order to test this change.

[Alex Murray (alexmurray)]

LGTM but I wonder if the code which extracts the pocket from the release needs to be a bit more stricter.

review: Approve

[Paulo Flabiano Smorigo (pfsmorigo)]

Hey Alex, I'll soon create another PR to include other possible pockets, like fips, after I have clear view about what we want. I'll try to follow your suggestion.

diff --git a/scripts/publish-cves-to-website-api.py b/scripts/publish-cves-to-website-api.py
index 99c95b9..aa80880 100755
--- a/scripts/publish-cves-to-website-api.py
+++ b/scripts/publish-cves-to-website-api.py
@@ -114,6 +114,7 @@ def post_single_cve(cve_filename):
 
         for codename in cve_lib.releases + ["upstream"]:
             status = None
+            pocket = "security"
 
             # Set the public release first
             if codename in cve_data["pkgs"][pkg]:
@@ -121,12 +122,19 @@ def post_single_cve(cve_filename):
 
             if status and status[0] != "released" and codename in cve_lib.get_active_releases_with_esm():
                 # Check for possible product statuses
-                for release in [codename + "/esm", "esm-infra/" + codename,
-                        "esm-apps/" + codename, "ros-esm/" + codename, codename]:
+                for release in [
+                        codename + "/esm",
+                        "esm-infra/" + codename,
+                        "esm-apps/" + codename,
+                        "ros-esm/" + codename,
+                        codename]:
                     if release in cve_data["pkgs"][pkg]:
                         esm_status = cve_data["pkgs"][pkg][release]
                         # Use the ESM status if there is an ESM release or release is EOL
                         if esm_status[0] == "released" or codename in cve_lib.eol_releases:
+                            if esm_status[0] == "released" and "esm" in release:
+                                pocket = "esm-infra" if codename == "trusty" \
+                                        else release.split("/")[0]
                             status = esm_status
                             break
 
@@ -136,6 +144,7 @@ def post_single_cve(cve_filename):
                         "release_codename": codename,
                         "status": status[0],
                         "description": status[1],
+                        "pocket": pocket,
                     }
                 )
         package = {
diff --git a/test/website_api/use_esm_status_for_eol_releases.json b/test/website_api/use_esm_status_for_eol_releases.json
index 4dc91aa..095e819 100644
--- a/test/website_api/use_esm_status_for_eol_releases.json
+++ b/test/website_api/use_esm_status_for_eol_releases.json
@@ -8,9 +8,11 @@
                 "name": "package",
                 "source": "https://launchpad.net/ubuntu/+source/package",
                 "statuses": [{"description": "",
+                              "pocket": "security",
                               "release_codename": "trusty",
                               "status": "needed"},
                              {"description": "",
+                              "pocket": "security",
                               "release_codename": "upstream",
                               "status": "needs-triage"}],
                 "ubuntu": "https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=package"}],
diff --git a/test/website_api/use_esm_status_if_esm_release b/test/website_api/use_esm_status_if_esm_release
index 9281cbb..80cf454 100644
--- a/test/website_api/use_esm_status_if_esm_release
+++ b/test/website_api/use_esm_status_if_esm_release
@@ -18,6 +18,8 @@ CVSS:
 
 Patches_package:
 upstream_package: needs-triage
+trusty_package: needs-triage
+trusty/esm_package: released (1.0.0~esm1)
 focal_package: needs-triage
 esm-apps/focal_package: released (1.2.3~esm1)
 jammy_package: needed
diff --git a/test/website_api/use_esm_status_if_esm_release.json b/test/website_api/use_esm_status_if_esm_release.json
index b198bd5..4ea6d3f 100644
--- a/test/website_api/use_esm_status_if_esm_release.json
+++ b/test/website_api/use_esm_status_if_esm_release.json
@@ -7,13 +7,20 @@
   "packages": [{"debian": "https://tracker.debian.org/pkg/package",
                 "name": "package",
                 "source": "https://launchpad.net/ubuntu/+source/package",
-                "statuses": [{"description": "1.2.3~esm1",
+                "statuses": [{"description": "1.0.0~esm1",
+                              "pocket": "esm-infra",
+                              "release_codename": "trusty",
+                              "status": "released"},
+                             {"description": "1.2.3~esm1",
+                              "pocket": "esm-apps",
                               "release_codename": "focal",
                               "status": "released"},
                              {"description": "1.2.4~esm1",
+                              "pocket": "esm-apps",
                               "release_codename": "jammy",
                               "status": "released"},
                              {"description": "",
+                              "pocket": "security",
                               "release_codename": "upstream",
                               "status": "needs-triage"}],
                 "ubuntu": "https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=package"}],
diff --git a/test/website_api/use_public_status_for_no_eol_releases.json b/test/website_api/use_public_status_for_no_eol_releases.json
index 4eff239..0ea071c 100644
--- a/test/website_api/use_public_status_for_no_eol_releases.json
+++ b/test/website_api/use_public_status_for_no_eol_releases.json
@@ -8,9 +8,11 @@
                 "name": "package",
                 "source": "https://launchpad.net/ubuntu/+source/package",
                 "statuses": [{"description": "",
+                              "pocket": "security",
                               "release_codename": "jammy",
                               "status": "needed"},
                              {"description": "",
+                              "pocket": "security",
                               "release_codename": "upstream",
                               "status": "needs-triage"}],
                 "ubuntu": "https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=package"}],
diff --git a/test/website_api/use_public_status_if_public_release.json b/test/website_api/use_public_status_if_public_release.json
index ffcd35e..e813ffa 100644
--- a/test/website_api/use_public_status_if_public_release.json
+++ b/test/website_api/use_public_status_if_public_release.json
@@ -8,12 +8,15 @@
                 "name": "package",
                 "source": "https://launchpad.net/ubuntu/+source/package",
                 "statuses": [{"description": "1.2.3",
+                              "pocket": "security",
                               "release_codename": "trusty",
                               "status": "released"},
                              {"description": "4.5.6",
+                              "pocket": "security",
                               "release_codename": "jammy",
                               "status": "released"},
                              {"description": "",
+                              "pocket": "security",
                               "release_codename": "upstream",
                               "status": "needs-triage"}],
                 "ubuntu": "https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=package"}],
diff --git a/test/website_api/use_ros-esm_status.json b/test/website_api/use_ros-esm_status.json
index 199d4ce..6588aa7 100644
--- a/test/website_api/use_ros-esm_status.json
+++ b/test/website_api/use_ros-esm_status.json
@@ -8,9 +8,11 @@
                 "name": "package",
                 "source": "https://launchpad.net/ubuntu/+source/package",
                 "statuses": [{"description": "1.2.3",
+                              "pocket": "ros-esm",
                               "release_codename": "bionic",
                               "status": "released"},
                              {"description": "",
+                              "pocket": "security",
                               "release_codename": "upstream",
                               "status": "needs-triage"}],
                 "ubuntu": "https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=package"}],