ones

I think the affected_pkgs here is the list of package names, while the srpm_nvrs is list of NVRs. For example, the values will be like this:

affected_pkgs = set(["httpd"])
srpm_nvrs = set(["httpd-2.4.6-11", "foo-1-1"])

See my comment below for more info.

The goal of this line should be to keep only "affected" NVRs in the srpm_nvrs - it means you should keep the srpm_nvr which has the same name as the one in affected_pkgs.

Maybe something like this:

if affected_pkgs:
    set([srpm_nvr for srpm_nvr in srpm_nvrs if kobo.rpmlib.parse_nvr(srpm_nvr)["name"] in affected_pkgs])

Can you also call self.log_info() with some message showing the list of removed SRPM NVRs, so we know that some NVRs were removed?

The pkg_name returned by Bugzilla is just httpd.

You will need to change the test to include more packages, not just httpd. But even in the current test, this should be httpd-2.4-11.el7, because that's the NVR affected by CVE.

You will need to change the test to include more packages, not just httpd. But even in the current test, this should be httpd-2.4-11.el7, because that's the NVR affected by CVE.

Yeah... actually I made the opposite. I shouldn't remove the affected pkgs, I should use them as a whitelist.

@jkaluza this is ready for another review.

+1

Commit 241287d1 fixes this pull-request