PR#402: Find out which pkgs in the advisory fix the CVE -

freshmaker

#402 Find out which pkgs in the advisory fix the CVE

Merged Jul 17, 2019 by jkaluza. Opened Jul 15, 2019 by gnaponie.

gnaponie/freshmaker pkgs-fix-cve into master

gnaponie commented Jul 15, 2019

An RHSA that addresses a specific advisory will contain RPM build(s)
for addressing a specific CVE. Freshmaker uses these RPM build(s) to
find out which images should be rebuilt. In some cases, additional
RPM build(s) are attached to RHSA. These are unrelated to the CVE.
With this change Freshmaker is going to find out which are the pkgs
in the advisory actually fix the CVE.

Signed-off-by: gnaponie gnaponie@redhat.com

lucarval commented Jul 15, 2019

Are we expecting anything other than IndexError here?

lucarval commented Jul 15, 2019

I'm missing where affected_pkgs is actually used.

jkaluza commented Jul 16, 2019

I'm missing where affected_pkgs is actually used.

That will be in next PR. I've advised to split these into two PRs to make them smaller and more focused.

jkaluza commented Jul 16, 2019

I think the pkg_name should be set to pkg.split('/')[-1], because in case of modules, the format is product/module_nsvc/pkg_name. We should still return pkg_name in this case.