[GSOC23] - D - Define RPC endpoints for listing the affected packages regarding a CVE by HoussemNasri · Pull Request #7570 · uyuni-project/uyuni

HoussemNasri · 2023-09-21T09:02:19Z

What does this PR change?

Scanning for a CVE from the web UI will give you whether your system is vulnerable or not along with patches to apply. But you don't know what packages need to be patched. This information is not important if Uyuni could apply the patch automatically, but if the patch is unavailable, you'll need to know what packages to patch manually. The goal of this pull request is to provide users with the list of packages to be patched regarding a particular CVE. All from Spacecmd.

GUI diff

No difference.

DONE

Documentation

No documentation needed: add explanation. This can't be used if there is a GUI diff
No documentation needed: only internal and user invisible changes
Documentation issue was created: Link for SUSE Manager contributors, Link for community contributors.
API documentation added: please review the Wiki page Writing Documentation for the API if you have any changes to API documentation.
(OPTIONAL) Documentation PR
DONE

Test coverage

No tests: add explanation
No tests: already covered
Unit tests were added
Cucumber tests were added
DONE

Links

DONE

Changelogs

Make sure the changelogs entries you are adding are compliant with https://github.com/uyuni-project/uyuni/wiki/Contributing#changelogs and https://github.com/uyuni-project/uyuni/wiki/Contributing#uyuni-projectuyuni-repository

If you don't need a changelog check, please mark this checkbox:

No changelog needed

If you uncheck the checkbox after the PR is created, you will need to re-run changelog_test (see below)

Re-run a test

If you need to re-run a test, please mark the related checkbox, it will be unchecked automatically once it has re-run:

Re-run test "changelog_test"
Re-run test "backend_unittests_pgsql"
Re-run test "java_pgsql_tests"
Re-run test "schema_migration_test_pgsql"
Re-run test "susemanager_unittests"
Re-run test "javascript_lint"
Re-run test "spacecmd_unittests"

- This is a temporary implementation based on JAXB API which consumes a lot of memory. I plan to rewrite it with StAX for better performance.

- A utility class to access OVAL resources (tests, objects and states) by id and quickly

- Used to parse CPEs found in OVAL files.

- Used to create CPE objects for testing and for when CPE is not available in OVAL, and we need to create or infer our own.

- OVAL files usually encode vulnerable operating systems information as a CPE (Common Platform Enumeration). Therefore, in order to accurately audit client systems we need to store their CPE.

- Kind of migration strategy for minions that are already registered. Instead of re-registering the minion, users could update their package list to get assigned a CPE.

- Added AFFECTED_PARTIAL_PATCH_APPLICABLE and AFFECTED_PARTIAL_PATCH_APPLICABLE - Also renamed 'AFFECTED_PATCH_APPLICABLE' to 'AFFECTED_FULL_PATCH_APPLICABLE'

- This way when we can't audit a system with OVAL we can fall back to the old code.

- Because we don't need all the information contained in PackageListItem for CVE auditing.

- The idea here is decouple CVEAuditManager from the rest of the code by replacing all calls to CVEAuditManager to CVEAuditManagerOVAL, and make the CVEAuditManagerOVAL#doAuditSystem method fallback to CVEAuditManager#doAuditSystem when the system cannot be audited with OVAL (OVAL not synced or not supported by the system's OS). This way, in the future, when all distributions become supported for performing OVAL-based CVE auditing, we can just delete CVEAuditManager and its test class. - CVEAuditManager contains also methods for managing CVE channels. For now, we can create the same methods in CVEAuditManagerOVAL and redirect them to their equivalent in CVEAuditManager. But in the future, when we don't need CVEAuditManager anymore, we can move them entirely to CVEAuditManagerOVAL or put them in their own class. - The upside is that we can keep the tests for CVEAuditManager, which tests the channels-based algorithm, and we make the transition later when we don't need the channels algorithm anymore, easier. The downside is a lot of potential duplication in CVEAuditManagerOVAL tests given that need to maintain both channels and OVAL-based implementations.

- Now, CVEAuditManager is only used by CVEAuditManagerOVAL and CVEAuditManagerTest

- Also, updated the icons and colors of some patch statuses labels

github-actions · 2024-06-04T01:53:19Z