feat(evaluator): store affected + fixed associations

common/feature_flags.py

@@ -22,6 +22,7 @@
 OS_EXPOSURE_REPORT_FEATURE = "vulnerability.os_exposure_report"
 NEW_NOTIFICATIONS_FEATURE = "vulnerability.new_notifications"
 TIMING_LOG_FEATURE = "vulnerability.timing_log"
+EVALUATOR_SYSTEM_VULNERABILITIES_PKG_DETAIL_FEATURE = "vulnerability.evaluator_system_vulnerabilities_pkg_detail"
 
 
 class UnleashClientProxy:

develfeatureflags.json

@@ -56,6 +56,20 @@
       ],
       "strategy": "default",
       "parameters": {}
+    },
+    {
+      "name": "vulnerability.evaluator_system_vulnerabilities_pkg_detail",
+      "type": "release",
+      "enabled": true,
+      "stale": false,
+      "strategies": [
+        {
+          "name": "default",
+          "parameters": {}
+        }
+      ],
+      "strategy": "default",
+      "parameters": {}
     }
   ]
 }

evaluator/common.py

@@ -6,6 +6,7 @@
 import re
 from collections import namedtuple
 from dataclasses import dataclass
+from dataclasses import field
 from datetime import datetime
 from typing import Dict
 from typing import Optional
@@ -67,13 +68,20 @@
 EvrCache = namedtuple("EvrCache", ["id"])
 # parsed EVRA data from VMAAS
 Evra = namedtuple("Evra", ["epoch", "version", "release", "arch"])
+# affected and fixed EVRAs returned by VMAAS for a package
+AffectedPackageEvras = namedtuple("AffectedPackageEvras", ["affected_evra", "fixed_evra"])
+# resolved package data stored for a system vulnerability
+SystemVulnerabilityPackageDetail = namedtuple(
+    "SystemVulnerabilityPackageDetail",
+    ["package_name_id", "affected_evr_id", "affected_arch", "fixed_evr_id", "fixed_arch"],
+)
 # single member inside cpe cache
 CpeCache = namedtuple("CpeCache", ["id"])
 # single member inside module cache
 ModuleCache = namedtuple("ModuleCache", ["id"])
 # single member inside vulnerable package cache
 VulnerablePackageCache = namedtuple("VulnerablePackageCache", ["id"])
-# cve coupled with its advisories and affected package-to-EVRA mapping, from vmaas
+# cve coupled with its advisories and affected package-to-EVRA-pair mapping, from vmaas
 CveAdvisories = namedtuple("Cve", ["name", "advisories", "affected_packages"])
 # cve coupled with its package name, EVRA, CPE and module, from vmaas
 CveUnpatched = namedtuple("Cve", ["cve", "package_name", "evra", "cpe", "module_name", "module_stream"])
@@ -139,6 +147,7 @@ class SystemVulnerabilitiesRow:
     mitigation_reason: str
 
     remediation_type_id: int = -1
+    affected_package_details: set[SystemVulnerabilityPackageDetail] = field(default_factory=set)
 
     def _populate_remediation_type(self):
         """Populate the remediation type id field"""