[Eandalf-Bigstack]

What type of PR is this?

/kind feature

What this PR does / why we need it

The vulnerability report's re-check gains a third source, the OpenStack Security Advisories, for cubecos's fourth 3.2.0 scan-review round, in two commits:

commit	change
70f3fcc	recheckvulns.py: OpenStack's python packages are re-judged by the OSSAs. grype matches OpenStack's own packages in the service venvs by GitHub's advisories, which can name only the newest series' fix where an OSSA fixed every maintained series. OSSA-2026-007 fixed keystone in 25.0.1, 26.1.1, 27.0.1 and 28.0.1, but its GitHub advisory says < 28.0.1, so a 27.1.0 that carries the fix is reported. The new --ossa pass keeps a checkout of openstack/ossa (opendev.org; OSSA_GIT for a mirror), updated between scans like the kernel CNA's. A python match whose CVE an advisory names for that package is judged by the advisory's own affected versions: outside every range it moves to ignoredMatches with the advisory as the reason, and inside one it stays with that range's fix. projsbom.mk passes --ossa ossa-advisories, a checkout kept beside kernel-vulns.
58f1897	The OSSA pass compares in OpenStack's release order. OpenStack versioned its releases YYYY.N until Liberty (2015.2) and semantically since, but compared as numbers nova 31.3.1 sorts below 2014.1.4. GitHub's advisories state the oldest flaws' fixes as YYYY.N releases, so current releases are reported for flaws fixed in 2012 to 2015, and advisory ranges written in YYYY.N releases took them in too. The pass now compares in OpenStack's order, ranges included, and moves a match to ignoredMatches when the package is a project the advisories name, every fix grype names is a YYYY.N release, and the installed version is semantic. It also reads a range that five advisories split at its comma (>=25.0.0, <26.1.0) as one.

Which issue(s) this PR fixes

Refs bigstack-oss/cubecos#578

Special notes for your reviewer

Note

Pairs with bigstack-oss/cubecos#2122, whose hex bump points at 58f1897. Both repos merge fast-forward, so the SHA stays valid.

Conservative by design: a match is cleared by an advisory only when every advisory naming its CVE for the package gives version ranges; the oldest give prose (All versions, Folsom, Grizzly), and those matches are cleared only by the YYYY.N rule. A fix that is not entirely YYYY.N, an installed YYYY.N release, or a package that is not an OpenStack project the advisories name stays as grype has it. The advisories' YAML is read for its two blocks only (affected-products, vulnerabilities), without a YAML library, as the rest of the script needs none. Versions are compared in PEP 440 order (29.0.0.0rc1 < 29.0.0). The kernel pass's clone-or-update is shared with the new one; its behavior is unchanged.

Verification:

• Unit tests: scripts/tests/test_recheckvulns.sh, 104 checks, 40 of them new. They cover ranges per series, an affected version keeping its series' fix, product names in any case, quoted and annotated CVE ids, prose versions, a CVE named for another package, YYYY.N fixes and ranges against semantic versions, calendar-versioned packages left alone, split ranges, an advisory updated between scans, an unreachable checkout, and no fetch without --ossa or a python match. test_projsbom.sh passes its 12 checks with the new argument.
• On a real report: run over the jim build's 3.2.0 report with the opendev checkout. The pass found 17 matches that an advisory names for their package and moves all 17 to ignoredMatches: 7 by the advisory's own ranges, each version past its series' fix, and 10 by a YYYY.N fix. With only the first commit it moved 5.

Additional documentation

NONE

🤖 Generated with Claude Code