R-1303: watch — abandoned templates are GAP, a seed's unread pins stay pending (no storm after a seed); 38 checks

scripts/security_watch.py

@@ -385,6 +385,13 @@ def newest_in_channel(tag, names):
 
 def check_item(it, src, today):
     """-> the item with `class`, `advisories`, `not_checked`, `behind`, `notes` filled in."""
+    if it.get("abandoned"):
+        it.update({"advisories": [], "not_checked": [], "behind": None, "class": "GAP",
+                   "notes": ["abandoned upstream (lifecycle: abandoned) — no fix will ever come; not looked up"]})
+        if it.get("problems"):
+            it["not_checked"].append({"source": "inventory", "why": "; ".join(it["problems"])})
+            it["class"] = "NOT CHECKED"
+        return it
     ours = version_of(it["tag"])
     floating = is_floating(it["tag"])
     advs, nc, notes = [], [], []
@@ -394,6 +401,7 @@ def check_item(it, src, today):
             if kind in ("github", "advisories"):
                 if src.rotate and it["group"] == "app" and (zlib.crc32(arg.encode()) + today.toordinal()) % 2:
                     notes.append("advisories of %s: read tomorrow (no-key rotation)" % arg)
+                    it["adv_unread"] = True
                 elif floating:
                     notes.append("advisories of %s: not matched (floating tag)" % arg)
                 else:
@@ -455,6 +463,7 @@ def check_item(it, src, today):
                                              "link": VULNNOTES[arg]["url"]})
         except SourceError as e:
             nc.append({"source": source_name(kind, arg), "why": str(e)})
+            it["adv_unread"] = True
     behind, newer_major = None, None
     if it.get("no_registry"):
         gh = next((a for k, a in it.get("sources") or [] if k == "github"), None)
@@ -525,6 +534,24 @@ def plan(items, state, today, seed=False):
             checked_images.add(it["image"])
         for a in it.get("advisories", []):
             open_now[adv_key(it, a)] = (it, a)
+    # A seed that could not read some pins (no key: rotation; or a source down) leaves them PENDING: their first real
+    # read is recorded silently too, so the first nights after a seed are no mail storm. A pin added later is never
+    # pending, so its advisories mail normally.
+    pending = set(st.get("seed_pending", []))
+    if seed:
+        pending = {it["image"] for it in items if it.get("adv_unread")}
+    else:
+        for it in items:
+            if it["image"] in pending and not it.get("adv_unread"):
+                for a in it.get("advisories", []):
+                    k = adv_key(it, a)
+                    if k not in known:
+                        known[k] = {"first": iso, "last_mailed": iso, "program": label(it), "summary": a["summary"][:160],
+                                    "silent": "first read after the seed"}
+                        would.append({"kind": "advisory", "subject": "(silent, first read after the seed) %s %s" % (
+                            it["image"], a["id"]), "text": ""})
+                pending.discard(it["image"])
+    st["seed_pending"] = sorted(pending)
     new, remind = [], []
     for k, (it, a) in sorted(open_now.items()):
         if k not in known:
@@ -627,7 +654,8 @@ def weekly_mail(items, today):
     lines += block("Open advisories (mailed already):", sorted({"%s %s — %s" % (it["image"], it["tag"], a["id"])
                                                               for it in items for a in it.get("advisories", [])}))
     lines += block("No machine-readable source (GAP) — not watched for notices:",
-                   sorted({"%s — %s" % (it["image"], next((v for k, v in it.get("sources", []) if k == "gap"), ""))
+                   sorted({"%s — %s" % (it["image"], next((v for k, v in it.get("sources", []) if k == "gap"),
+                                                         "; ".join(it.get("notes", []))))
                            for it in items if it.get("class") == "GAP"}))
     lines += block("Floating tags (no exact version to match a notice against):",
                    sorted({"%s:%s (%s)" % (it["image"], it["tag"], it["owner"]) for it in items if it.get("class") == "FLOATING"}))