fix: ignore updates from rhel-alt el7a release

vmaas/common.go

@@ -683,7 +683,11 @@ func cveMapValues(cves map[string]VulnerabilityDetail) []VulnerabilityDetail {
 	return vals
 }
 
-func isApplicable(c *Cache, update, input *utils.Nevra) bool {
+func isApplicable(c *Cache, update, input *utils.Nevra, opts *options) bool {
+	splittedRelease := strings.Split(update.Release, ".")
+	if opts.excludedReleases[splittedRelease[len(splittedRelease)-1]] {
+		return false
+	}
 	if update.Name != input.Name {
 		return false
 	}

vmaas/common_test.go

@@ -570,25 +570,25 @@ func TestIsApplicabe(t *testing.T) {
 	bash := pkgID2Nevra(&c, 7)
 
 	// newer noarch is applicable to all other archs
-	assert.True(t, isApplicable(&c, &kernelNoarchNew, &kernelNoarch))
-	assert.True(t, isApplicable(&c, &kernelNoarchNew, &kernelX86))
-	assert.True(t, isApplicable(&c, &kernelNoarchNew, &kernelAarch))
+	assert.True(t, isApplicable(&c, &kernelNoarchNew, &kernelNoarch, &defaultOpts))
+	assert.True(t, isApplicable(&c, &kernelNoarchNew, &kernelX86, &defaultOpts))
+	assert.True(t, isApplicable(&c, &kernelNoarchNew, &kernelAarch, &defaultOpts))
 	// newer x86_64 kernel can be applied only on x86_64 or noarch
-	assert.True(t, isApplicable(&c, &kernelX86New, &kernelX86))
-	assert.True(t, isApplicable(&c, &kernelX86New, &kernelNoarch))
+	assert.True(t, isApplicable(&c, &kernelX86New, &kernelX86, &defaultOpts))
+	assert.True(t, isApplicable(&c, &kernelX86New, &kernelNoarch, &defaultOpts))
 	// x86_64 cannot be applied on aarch64 and vice versa
-	assert.False(t, isApplicable(&c, &kernelX86New, &kernelAarch))
-	assert.False(t, isApplicable(&c, &kernelAarchNew, &kernelX86))
+	assert.False(t, isApplicable(&c, &kernelX86New, &kernelAarch, &defaultOpts))
+	assert.False(t, isApplicable(&c, &kernelAarchNew, &kernelX86, &defaultOpts))
 	// same or older version cannot be applied
-	assert.False(t, isApplicable(&c, &kernelNoarch, &kernelNoarch))
-	assert.False(t, isApplicable(&c, &kernelX86, &kernelX86))
-	assert.False(t, isApplicable(&c, &kernelAarch, &kernelAarch))
-	assert.False(t, isApplicable(&c, &kernelNoarch, &kernelNoarchNew))
-	assert.False(t, isApplicable(&c, &kernelX86, &kernelX86New))
-	assert.False(t, isApplicable(&c, &kernelAarch, &kernelAarchNew))
-	assert.False(t, isApplicable(&c, &kernelNoarch, &kernelX86))
-	assert.False(t, isApplicable(&c, &kernelNoarch, &kernelAarchNew))
+	assert.False(t, isApplicable(&c, &kernelNoarch, &kernelNoarch, &defaultOpts))
+	assert.False(t, isApplicable(&c, &kernelX86, &kernelX86, &defaultOpts))
+	assert.False(t, isApplicable(&c, &kernelAarch, &kernelAarch, &defaultOpts))
+	assert.False(t, isApplicable(&c, &kernelNoarch, &kernelNoarchNew, &defaultOpts))
+	assert.False(t, isApplicable(&c, &kernelX86, &kernelX86New, &defaultOpts))
+	assert.False(t, isApplicable(&c, &kernelAarch, &kernelAarchNew, &defaultOpts))
+	assert.False(t, isApplicable(&c, &kernelNoarch, &kernelX86, &defaultOpts))
+	assert.False(t, isApplicable(&c, &kernelNoarch, &kernelAarchNew, &defaultOpts))
 	// bash cannot be update for kernel or kernel for bash
-	assert.False(t, isApplicable(&c, &bash, &kernelNoarch))
-	assert.False(t, isApplicable(&c, &kernelNoarchNew, &bash))
+	assert.False(t, isApplicable(&c, &bash, &kernelNoarch, &defaultOpts))
+	assert.False(t, isApplicable(&c, &kernelNoarchNew, &bash, &defaultOpts))
 }

vmaas/options.go

@@ -1,11 +1,14 @@
 package vmaas
 
-var defaultOpts = options{20, true, map[string]bool{"kernel-alt": true}, true, true}
+var defaultOpts = options{
+	20, true, map[string]bool{"kernel-alt": true}, map[string]bool{"el7a": true}, true, true,
+}
 
 type options struct {
 	maxGoroutines        int
 	evalUnfixed          bool
 	excludedPackages     map[string]bool
+	excludedReleases     map[string]bool
 	newerReleaseverRepos bool
 	newerReleaseverCsaf  bool
 }
@@ -55,6 +58,17 @@ func WithExcludedPackages(pkgs map[string]bool) Option {
 	return excludedPkgsOption(pkgs)
 }
 
+type excludedRelsOption map[string]bool
+
+func (p excludedRelsOption) apply(opts *options) {
+	opts.excludedReleases = p
+}
+
+// Option to set excluded package releases
+func WithExcludedReleases(rel map[string]bool) Option {
+	return excludedRelsOption(rel)
+}
+
 type newerReleaseverReposOption bool
 
 func (n newerReleaseverReposOption) apply(opts *options) {

vmaas/vulnerabilities.go

@@ -123,7 +123,7 @@ func evaluate(c *Cache, opts *options, request *Request) (*VulnerabilitiesCvesDe
 
 	// 3. evaluate Manually Fixable CVEs
 	// if CVE is already in Unpatched or CVE list -> skip it
-	evaluateManualCves(c, products, &cves)
+	evaluateManualCves(c, products, &cves, opts)
 	return &cves, nil
 }
 
@@ -157,7 +157,7 @@ func evaluateUnpatchedCves(c *Cache, products []ProductsPackage, cves *Vulnerabi
 	}
 }
 
-func evaluateManualCves(c *Cache, products []ProductsPackage, cves *VulnerabilitiesCvesDetails) {
+func evaluateManualCves(c *Cache, products []ProductsPackage, cves *VulnerabilitiesCvesDetails, opts *options) {
 	for _, pp := range products {
 		pp := pp // make copy because &pp is used
 		seenProducts := make(map[CSAFProduct]bool, len(pp.ProductsFixed))
@@ -169,7 +169,7 @@ func evaluateManualCves(c *Cache, products []ProductsPackage, cves *Vulnerabilit
 			}
 			seenProducts[product] = true
 			updateNevra := pkgID2Nevra(c, product.PackageID)
-			if !isApplicable(c, &updateNevra, &pp.Package.Nevra) {
+			if !isApplicable(c, &updateNevra, &pp.Package.Nevra, opts) {
 				continue
 			}
 

vmaas/vulnerabilities_test.go

@@ -99,7 +99,7 @@ func TestCSAF(t *testing.T) {
 		UnpatchedCves: make(map[string]VulnerabilityDetail),
 	}
 	evaluateUnpatchedCves(&c, products, &cves)
-	evaluateManualCves(&c, products, &cves)
+	evaluateManualCves(&c, products, &cves, &defaultOpts)
 
 	unpatchedCves := maps.Keys(cves.UnpatchedCves)
 	manualCves := maps.Keys(cves.ManualCves)