feat(evaluator): store affected + fixed associations

[jdobes]

RHINENG-28512

Secure Coding Practices Checklist GitHub Link

• https://github.com/RedHatInsights/secure-coding-checklist

Secure Coding Checklist

• Input Validation
• Output Encoding
• Authentication and Password Management
• Session Management
• Access Control
• Cryptographic Practices
• Error Handling and Logging
• Data Protection
• Communication Security
• System Configuration
• Database Security
• File Management
• Memory Management
• General Coding Practices

Summary by Sourcery

Enable the evaluator to persist and synchronize affected and fixed package associations for system vulnerabilities.

New Features:

• Store affected and fixed package EVRA details for system vulnerabilities, including package architecture and remediation information.
• Synchronize vulnerability package-detail associations as vulnerabilities are evaluated.

Enhancements:

• Add feature-flagged support for tracking and updating affected EVR data on system vulnerable packages while preserving the existing evaluation path.

[sourcery-ai]

Reviewer's Guide

Introduces a feature-flagged evaluator path that resolves VMAAS affected/fixed EVRAs and synchronizes both system vulnerability package metadata and detailed package associations, while preserving backward-compatible evaluation behavior when disabled.

Sequence diagram for feature-flagged vulnerability package detail synchronization

sequenceDiagram
    participant VMAAS
    participant EvaluatorLogic
    participant SystemVulnerability
    participant PackageDetail
    participant Database

    VMAAS->>EvaluatorLogic: _perform_vmaas_request()
    EvaluatorLogic->>EvaluatorLogic: _get_affected_package_details()
    EvaluatorLogic->>EvaluatorLogic: _get_or_upsert_package_name()
    EvaluatorLogic->>EvaluatorLogic: _get_or_upsert_evra()
    EvaluatorLogic->>SystemVulnerability: _compare_system_vulnerable_package()
    alt feature flag enabled
        EvaluatorLogic->>Database: _insert_system_vulnerable_package()
        EvaluatorLogic->>Database: _update_system_vulnerable_package()
    else feature flag disabled
        EvaluatorLogic->>Database: _insert_system_vulnerable_package()
    end
    EvaluatorLogic->>PackageDetail: SystemVulnerabilitiesRow.affected_package_details
    PackageDetail->>Database: _sync_system_vulnerability_package_details()
    Database-->>PackageDetail: Insert missing and delete obsolete associations

Loading

Flow diagram for synchronizing affected and fixed package details

flowchart TD
    A[VMAAS affected package data] --> B[Resolve package names and EVRAs]
    B --> C[Build affected_package_details]
    C --> D[Evaluate system vulnerabilities]
    D --> E{Feature flag enabled?}
    E -- No --> F[Preserve legacy package evaluation]
    E -- Yes --> G[Compare affected EVRAs]
    G --> H[Insert new or update changed system packages]
    G --> I[Load existing package details]
    I --> J[Compare associations]
    J --> K[Insert missing affected/fixed details]
    J --> L[Delete obsolete details]

Loading

File-Level Changes

Change	Details	Files
Add feature-flagged parsing and persistence of affected and fixed package EVRA associations from VMAAS.	Represent affected/fixed EVRA pairs and resolve package, EVR, and architecture IDs. Attach resolved package details to evaluated system vulnerability rows. Support legacy parsing behavior for manually fixable and unpatched vulnerability data.	common/feature_flags.py develfeatureflags.json evaluator/common.py evaluator/logic.py
Synchronize system vulnerability package records when affected EVR data changes.	Load existing affected EVR and architecture values for comparison. Insert new package associations, update changed affected EVR values, and delete obsolete associations. Retain the existing insert/delete-only behavior when the feature flag is disabled.	evaluator/logic.py
Synchronize detailed affected/fixed package associations for active system vulnerabilities.	Load existing detail rows and compute set differences against current evaluation results. Insert missing details and remove redundant details using resolved package, EVR, architecture, and fixed-version fields. Map both existing and newly inserted system vulnerability IDs before detail synchronization.	evaluator/processor.py

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've found 1 issue

Prompt for AI Agents

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="evaluator/logic.py" line_range="487-489" />
<code_context>
       "strategy": "default",
       "parameters": {}
+    },
+    {
+      "name": "vulnerability.evaluator_system_vulnerabilities_pkg_detail",
+      "type": "release",
</code_context>
<issue_to_address>
**issue (bug_risk):** The dictionary comprehensions key affected records only by `package_name`, so multiple VMAAS affected entries for the same package name overwrite one another and only one architecture/affected EVRA/fixed EVRA is stored. The evaluator therefore loses package-detail associations when VMAAS returns the same package in more than one affected form.

**Triggers:** When VMAAS returns duplicate package names with different architectures or EVRA values.

**Suggested fix:** Group affected records by package name and preserve all records, or include the architecture/EVRA identity in the association key.
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

[sourcery-ai]

issue (bug_risk): The dictionary comprehensions key affected records only by package_name, so multiple VMAAS affected entries for the same package name overwrite one another and only one architecture/affected EVRA/fixed EVRA is stored. The evaluator therefore loses package-detail associations when VMAAS returns the same package in more than one affected form.

Triggers: When VMAAS returns duplicate package names with different architectures or EVRA values.

Suggested fix: Group affected records by package name and preserve all records, or include the architecture/EVRA identity in the association key.