FAILED test/test_available_fix.py::TestAvailableFixReport::test_redhat_available_fix_output

[terriko]

Looks like redhat has new fix information and the available fix test is failing on main now. We need to update the test to take the new output into account, and we may want to adjust the scope of the assert so that it isn't as brittle to future changes.

Updating the test should be a pretty beginner-friendly task so I'm flagging it as such.

Making the test more stable may be harder: Pinging @BreadGenie who's probably best positioned to know what could be improved here to make the test more stable.

[Antsthebul]

Mind if I give it a shot? I think I can use this tool on AWS linux servers since theyre based off Fedora.

[BreadGenie]

seems like Red Hat changed the affected status of those CVEs(CVE-2021-22918, CVE-2021-22931, CVE-2021-22939, CVE-2021-22940) for RHEL 8 as not affected. We most probably want to look for other CVEs that are fixed by Red Hat to update the test.

[BreadGenie]

on further investigation the packages in affected_release from the API all have fixes as per https://access.redhat.com/security/cve/CVE-2021-22918 but the package state section or affected_release section doesn't specify if there are fixes. Which means they aren't being explicit in saying that a certain package is fixed in the API.

So we need to make changes in the available_fix utility and not the tests.

[BreadGenie]

Seems like I made a blunder while designing the utility. I assumed all packages in package_state with Affected status have fixes mentioned in upstream_fix. But it's not the case. All packages in affected_release have fixes and others don't. It's just that Red Hat folks didn't explicitly say that the packages specified in affected_release only have fixes.