Update vulnerabilities CVE endpoint #3386

lucasmoura · 2025-01-30T20:18:01Z

Why is this needed?

We have redesigned the vulnerabilities CVE endpoint to per-package instead of per-cve. Now, each installed package will list all of the CVEs that it is affected by.

Test Steps

Run the new integration test created for the endpoint
Check that the vulnerability caches are still behaving correctly

(un)check this to re-run the checklist action

github-actions · 2025-01-30T20:18:22Z

PR Checklist

How to use this checklist

PR Author

For each section, check a box when it is true.
Uncheck a box if it becomes un-true.
Then check the box at the bottom of the PR description to re-run the action that creates this checklist.
The action that creates and updates this comment will retain your edits.
The action will fail if the checklist is not completed.

PR Reviewer

Check that the PR checklist action did not fail.
Double check that the author filled out the checklist accurately.
If you disagree with a checklist item, start a conversation.
For example, the author may say they don't think integration tests are necessary, but you may disagree.

Bug References

None.

Confirm

I've properly referenced all bugs that this PR fixes

How to properly reference fixed bugs

If this PR is related to a Jira item, include an SC-1234 reference in the PR title
If this PR is fixes a GitHub issue, include a Fixes: #1234 reference in the commit that fixes the issue
If this PR is fixes a Launchpad bug, include a LP: #12345678 reference in the commit that fixes the issue

Test Updates

Unit Tests

I have updated or added any unit tests accordingly
No unit test changes are necessary for this change

Integration Tests

I have updated or added any integration tests accordingly
No integration test changes are necessary for this change

Documentation

Changes here need to be documented and I have referenced the docs PR in the description
No documentation updates are necessary for this change

Does this PR require review from someone outside the core ubuntu-pro-client team?

Yes, and I have requested those reviews via GitHub
No

uaclient/data_types.py

uaclient/messages/__init__.py

features/api/vulnerabilities_cve.feature

renanrodrigo · 2025-02-06T07:20:24Z

rebased to accomodate commits from #3384

renanrodrigo · 2025-02-06T07:30:02Z

Xenial build now broken on a dict comparison - maybe ordering?

Similar to the data_list function, we are now creating a data_dict function to support dict objects on our DataObject definitions

The redesigned endpoint is now orientend per-package instead of per-cve. This endpoint will be the base for the vulnerability CLI commands, that will also be redesigned

Add the related_packages to each vulnerability CVE that we have, as this information will be required in some CLI commands of Pro

We are now hiding some fields that are only usefull when we are writing our CLI related CVE features

lucasmoura · 2025-02-07T13:21:13Z

@renanrodrigo I have updated the PR and fixed the affected integration tests related to this change

orndorffgrant · 2025-02-07T14:40:24Z

uaclient/api/u/pro/security/cves/cve/v1.py

@@ -1,13 +1,12 @@
 import datetime


During the rename, this file was left behind. I believe all of uaclient/api/u/pro/security/cves/cve/* can be deleted

orndorffgrant · 2025-02-07T14:41:32Z

uaclient/api/u/pro/security/cves/_common/v1.py

@@ -182,9 +182,6 @@ def get_published_date(self):
        return vulnerability_json_data["published_at"]


You don't need to make a change, but I suppose the _common structure is not needed anymore since there is only one API endpoint.

orndorffgrant · 2025-02-07T14:42:08Z

uaclient/cli/vulnerability/update.py

@@ -1,7 +1,5 @@
 from uaclient import messages


why was update left behind if we're deleting the other two vulnerability commands in this PR?

lucasmoura mentioned this pull request Jan 31, 2025

Redesign pro vulnerability cli commands #3387

Open

1 task

orndorffgrant reviewed Feb 3, 2025

View reviewed changes

lucasmoura force-pushed the update-cve-endpoint branch from 0306b2d to 66441a4 Compare February 4, 2025 21:05

renanrodrigo force-pushed the update-cve-endpoint branch from a785e2b to b2303ba Compare February 6, 2025 07:19

lucasmoura force-pushed the update-cve-endpoint branch from b2303ba to 9168c51 Compare February 6, 2025 13:41

lucasmoura added 8 commits February 6, 2025 10:43

Remove old vulnerability commands

ffade2e

Add Dict DataValue support

7355035

Similar to the data_list function, we are now creating a data_dict function to support dict objects on our DataObject definitions

Support overlay response for download xz function

66d929d

Redesign vulnerabilities cve endpoint

065bf14

The redesigned endpoint is now orientend per-package instead of per-cve. This endpoint will be the base for the vulnerability CLI commands, that will also be redesigned

api: add related_packages to vulnerabilities cve

d00e6b0

Add the related_packages to each vulnerability CVE that we have, as this information will be required in some CLI commands of Pro

api: update example for vulnerabilities cve

22b2cdc

api: rename cve endpoint to u.pro.security.cves.v1

e20af99

api: hide cves fields that are only usefull on cli

5c74bf6

We are now hiding some fields that are only usefull when we are writing our CLI related CVE features

lucasmoura force-pushed the update-cve-endpoint branch from 9168c51 to 5c74bf6 Compare February 6, 2025 13:43

tests: fix vulnerability API related tests

a52601e

orndorffgrant reviewed Feb 7, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update vulnerabilities CVE endpoint #3386

Update vulnerabilities CVE endpoint #3386

lucasmoura commented Jan 30, 2025

github-actions bot commented Jan 30, 2025 •

edited by orndorffgrant

Loading

How to use this checklist

PR Author

PR Reviewer

renanrodrigo commented Feb 6, 2025

renanrodrigo commented Feb 6, 2025 •

edited

Loading

lucasmoura commented Feb 7, 2025

orndorffgrant Feb 7, 2025

orndorffgrant Feb 7, 2025

orndorffgrant Feb 7, 2025

		@@ -182,9 +182,6 @@ def get_published_date(self):
		return vulnerability_json_data["published_at"]

Update vulnerabilities CVE endpoint #3386

Are you sure you want to change the base?

Update vulnerabilities CVE endpoint #3386

Conversation

lucasmoura commented Jan 30, 2025

Why is this needed?

Test Steps

github-actions bot commented Jan 30, 2025 • edited by orndorffgrant Loading

PR Checklist

How to use this checklist

PR Author

PR Reviewer

Bug References

Confirm

Test Updates

Unit Tests

Integration Tests

Documentation

Does this PR require review from someone outside the core ubuntu-pro-client team?

renanrodrigo commented Feb 6, 2025

renanrodrigo commented Feb 6, 2025 • edited Loading

lucasmoura commented Feb 7, 2025

orndorffgrant Feb 7, 2025

Choose a reason for hiding this comment

orndorffgrant Feb 7, 2025

Choose a reason for hiding this comment

orndorffgrant Feb 7, 2025

Choose a reason for hiding this comment

github-actions bot commented Jan 30, 2025 •

edited by orndorffgrant

Loading

renanrodrigo commented Feb 6, 2025 •

edited

Loading