Clair use public oval v2 data (quay#21)

* CLAIR-262: add oval v2 class for parsing oval manifest, tests

* removed unused import

* CLAIR-263: updated oval v2 class to check oval manifest for only new advisories, added tests

* CLAIR-263: updated struct names, cleanup in oval v2 class for checking oval manifest for new advisories, added comments, additional tests

* CLAIR-264: added parse utilities for cpe names and rpm names, tests

* CLAIR-264: added module namespace parsing, tests, cleanup

* CLAIR-269: added package filtering by arch, tests

* WIP: refactored oval2 plugin and tests, based on changes required for rpm parsing and efficient ordering of assessments for whether a given advisory is already processed

* WIP: additional refactor for oval2 plugin and tests, fix nvra parsing and db lookups for already-processed, refactored manifest entry processing to iterate processing by document instead of all at once

* fix refactor issue: restore rewire for vuln namespace

* fix refactor issue: add check for empty lookup date, update test to cover that case

* WIP: refactor, cleanup, and fixes related to most recent PR review notes

* WIP: additional refactor/cleanup from PR review

* ensure redhat package is enabled by default for make deploy-local

* updated logging for redhat package

* cleanup comments, clarify logging in redhat package

* updated logging in redhat package, cleanup, moved db key/val date write to post-gather loop, fixed struct xml attribute ref

* added check to prevent advisories with severity "none" from being stored to database, updated tests

* cleanup: removed trailing whitespace

* use all cpe entries from affected_cpe_list (previously was intentionally excluding the first entry)

* updated supported arch check to support pattern-based arch lists

* removed no longer used function (ParseCpeStructFromAffectedCpeList)

* removed no longer used function (ParseCpeName)

* cleanup - removed redundant variable usage in GatherUnprocessedAdvisories

* cleanup - removed redundant second parse for already-parsed package list

* updated feature creation for module namespaces, to create a feature for each namespace

* removed no longer used function (ConstructVulnerabilityNames)

* removed no longer used function (IsRmpArchSupported)

* updated supported arch check to use regexp matcher

* refactored updater to use map of flags instead of just one flag (FlagName+FlagValue)

- redhat package uses ovalv2, needs multiple flags to update multiple key/value processing status markers
- updated existing vulnsrc impls to use the flag map

* cleanup - removed no longer used functions, related tests

* updated dependencies in go.sum to point to public repo

* add separate flag for last advisory date

* added support for checking definition class, test; only process patch definitions

* removed redundant entries from supported definition types

* cleanup, add check for non-empty parsed nvra data

* cleanup, lint-related formatting/comments

* fixed errors in go.mod, go.sum from rebase conflicts

Signed-off-by: Ales Raszka <araszka@redhat.com>

cmd/clair/main.go

@@ -58,6 +58,7 @@ import (
 	_ "github.com/quay/clair/v3/ext/vulnsrc/amzn"
 	_ "github.com/quay/clair/v3/ext/vulnsrc/debian"
 	_ "github.com/quay/clair/v3/ext/vulnsrc/oracle"
+	_ "github.com/quay/clair/v3/ext/vulnsrc/redhat"
 	_ "github.com/quay/clair/v3/ext/vulnsrc/rhel"
 	_ "github.com/quay/clair/v3/ext/vulnsrc/suse"
 	_ "github.com/quay/clair/v3/ext/vulnsrc/ubuntu"