Merge ~rodrigo-zaiden/ubuntu-cve-tracker:check_cves_uris into ubuntu-cve-tracker:master

[Rodrigo Figueiredo Zaiden]

 scripts/check-cves: do not use allitems.xml by default

 if we set allitems.xml from MITRE by default, it is always loading
 that XML no matter if we have configured another path in
 .ubuntu-cve-tracker.conf file or not. instead, we should use that URL
 as a fallback if anything is set in the configuration file.

The idea of this commit is to re establish the MITRE's huge XML file
 https://cve.mitre.org/cve/downloads/allitems.xml
as the place to fetch for CVEs if, and only if, no other argument is used.
If we are using an specific source of CVEs to be imported we don't normally
use the 'allitems.xml' file from mitre.

Having it on default for the 'uris' argument, will make us check it no
matter if we have something being imported or not, that is, we will always
be checking 'allitems.xml' and what we passed along, for example:

if 'secure_testing_path' is setup in '~/.ubuntu-cve-tracker.conf' file and
we run:
 $UCT/scripts/check-cves --import-missing-debian
we are going to have:
 Loading /home/rodrigo/git-pulls/security-tracker/data/CVE/list ...
 Loading https://cve.mitre.org/cve/downloads/allitems.xml ...

when actually, the 'allitems.xml' used to be the fallback place to fetch
CVEs when another location is not set. at least this was the behavior
before commit 8b896cae083748f5bbec487d67cb33408a884c45.

The current behavior is happening because the mitre's URL is the default
for 'uris' and any other argument is appended to it.

The proposal is to move that URL back for the case that the script can't
find a proper place to look for CVEs.

[Marc Deslauriers (mdeslaur)]

LGTM, ack.

review: Approve

[Mark Esler (eslerm)]

Thank you Rodrigo!

Small style nitpick is that `if not args.uris:` feels cleaner than `if len(args.uris) == 0:`

Since an empty list evaluates to False: `bool([])`

(note that `nargs='*'` implicitly sets args.uris to a list)

review: Approve

diff --git a/scripts/check-cves b/scripts/check-cves
index e4ac77c..be0b713 100755
--- a/scripts/check-cves
+++ b/scripts/check-cves
@@ -47,7 +47,7 @@ uct_config = read_uct_config()
 
 # fmt: off
 parser = argparse.ArgumentParser(prog="check_cves", description="check_cves builds UCT with new CVE data")
-parser.add_argument('uris', nargs='*', default=["https://cve.mitre.org/cve/downloads/allitems.xml",])
+parser.add_argument('uris', nargs='*', help="URIs to fetch CVEs")
 parser.add_argument("-r", "--report", help="Just report CVEs that need checking", action="store_true")
 parser.add_argument("-v", "--verbose", help="Report verbose details", action="store_true")
 parser.add_argument("-d", "--debug", help="Report debugging information", action="store_true")
@@ -1462,6 +1462,8 @@ if (args.import_missing_debian or args.mistriaged) and handler.debian is not Non
     debian_import_json = import_debian(handler)
     args.uris.append(debian_import_json)
 
+if len(args.uris) == 0:
+    args.uris.append("https://cve.mitre.org/cve/downloads/allitems.xml")
 
 for uri in args.uris:
     print(f'Loading {uri} ...', file=sys.stderr)