search

AlmaLinux / build-system

The AlmaLinux OS project Build System documentation and issue tracker.
Creative Commons Attribution Share Alike 4.0 International
27 stars 10 forks source link

Reference id collisions in new OVAL XML produced after OVAL data migration #356

Closed javihernandez closed 1 month ago

javihernandez commented 1 month ago

As part of https://github.com/AlmaLinux/build-system/issues/355, I fixed inaccurate references in production OVAL to add new OVAL tests when required. However, during the old OVAL data migration, liboval's data generation is taking into account already created object/state/test ids in prod and in current data generation, but not tracking already added ones during the migration process, which led to the follwing example of id collision:

<criterion test_ref="oval:org.almalinux.alsa:tst:20233002003" comment="bind-chroot is earlier than 32:9.11.36-8.el8"/>
<criterion test_ref="oval:org.almalinux.alsa:tst:20233002003" comment="bind-export-libs is earlier than 32:9.11.36-8.el8"/>

The test itself is:

<red-def:rpminfo_test check="at least one" comment="bind-chroot is earlier than 32:9.11.36-8.el8" id="oval:org.almalinux.alsa:tst:20233002003" version="636">
  <red-def:object object_ref="oval:org.almalinux.alsa:obj:20191145002"/>
  <red-def:state state_ref="oval:org.almalinux.alsa:ste:20233002001"/>
</red-def:rpminfo_test>

Whose object ref is bind-chroot's one:

<red-def:rpminfo_object id="oval:org.almalinux.alsa:obj:20191145002" version="635">
  <red-def:name>bind-chroot</red-def:name>
</red-def:rpminfo_object>

We need to update liboval's data generator to take into account already existing tests (in prod, in current data generation AND in the migration process) when generating new ref ids to avoid such collisions. We also need to update the migration script, and probably, the current code in web_server that makes use of liboval's data generator.