Are we identifying all affected Ubuntu packages?

[johnmhoran]

While working on the SUSE Oval importer, I've been exploring the Debian and Ubuntu OVAL importers and noticed that in one set of test files, we are reporting potrace as an affected package but arguably should also report libpotrace0 as an affected package.

I think the relevant oval_parser.py code is here. This function searches the <object> element for a var_ref field and when found uses RegEx to extract the name of a package from the comment field.

With the test file ubuntu_oval_data.xml, for example, it seems the term potrace is extracted from comment="The 'potrace' package binaries." on line 83.

However, in the <variables> element below, there is not only a similar comment field, but two nested <value> elements, one with the text libpotrace0 and the other with the text potrace. I suspect that we actually want to report both of these as affected packages, but current report only potrace (see ubuntu-oval-expected.json).

BTW, based on minor sampling thus far, it appears that neither Debian nor SUSE includes a <variables> element in their respective OVAL XML structures.

[armijnhemel]

also see #1172

[johnmhoran]

Taking a new look at this issue I created, it strikes me as low priority at best and correctly tagged Data collection and enhancement, but does not concern data quality -- so I am removing that tag.