matcher: Use latest_vuln view in lieu of querying vuln table

[crozzy]

This view has always existed but never been used (AFAICT). Lately it has been problematic to query all of the vuln table as some vulnerabilities associated with older update_operations we're deleted or duplicated in new update_operations.

TODO

• Database performance analysis
• Tests

[crozzy]

Typical explain pre-change:

Bitmap Heap Scan on vuln  (cost=158.99..163.02 rows=1 width=1027)
  Recheck Cond: (((package_name = 'libgcc'::text) AND (package_module = ''::text) AND (repo_name = 'cpe:/a:redhat:rhel:8.3::appstream'::text)) OR ((package_name = 'gcc'::text) AND (package_module = ''::text) AND (repo_name = 'cpe:/a:redhat:rhel:8.3::appstream'::text)))
  Filter: (((package_name = 'libgcc'::text) AND (package_kind = 'binary'::text)) OR ((package_name = 'gcc'::text) AND (package_kind = 'source'::text)))
  ->  BitmapOr  (cost=158.99..158.99 rows=1 width=0)
        ->  Bitmap Index Scan on vuln_lookup_idx  (cost=0.00..79.50 rows=1 width=0)
              Index Cond: ((package_name = 'libgcc'::text) AND (package_module = ''::text) AND (repo_name = 'cpe:/a:redhat:rhel:8.3::appstream'::text))
        ->  Bitmap Index Scan on vuln_lookup_idx  (cost=0.00..79.50 rows=1 width=0)
              Index Cond: ((package_name = 'gcc'::text) AND (package_module = ''::text) AND (repo_name = 'cpe:/a:redhat:rhel:8.3::appstream'::text))

Typical explain post-change:

  ->  Hash  (cost=185.94..185.94 rows=3 width=1035)
        ->  Nested Loop  (cost=159.43..185.94 rows=3 width=1035)
              ->  Bitmap Heap Scan on vuln v  (cost=158.99..163.02 rows=1 width=1027)
                    Recheck Cond: (((package_name = 'libgcc'::text) AND (package_module = ''::text) AND (repo_name = 'cpe:/a:redhat:rhel:8.3::appstream'::text)) OR ((package_name = 'gcc'::text) AND (package_module = ''::text) AND (repo_name = 'cpe:/a:redhat:rhel:8.3::appstream'::text)))
                    Filter: (((package_name = 'libgcc'::text) AND (package_kind = 'binary'::text)) OR ((package_name = 'gcc'::text) AND (package_kind = 'source'::text)))
                    ->  BitmapOr  (cost=158.99..158.99 rows=1 width=0)
                          ->  Bitmap Index Scan on vuln_lookup_idx  (cost=0.00..79.50 rows=1 width=0)
                                Index Cond: ((package_name = 'libgcc'::text) AND (package_module = ''::text) AND (repo_name = 'cpe:/a:redhat:rhel:8.3::appstream'::text))
                          ->  Bitmap Index Scan on vuln_lookup_idx  (cost=0.00..79.50 rows=1 width=0)
                                Index Cond: ((package_name = 'gcc'::text) AND (package_module = ''::text) AND (repo_name = 'cpe:/a:redhat:rhel:8.3::appstream'::text))
              ->  Index Scan using uo_vuln_vuln_idx on uo_vuln  (cost=0.44..22.87 rows=5 width=16)
                    Index Cond: (vuln = v.id)

[crozzy]

The number of update_operations / updater should be bounded as long as GC is on. This has the potential to cause increased latency in vulnerability report generation for cases where GC is turned off.

[RTann]

Just for a sanity check, did you check that the unit test you added fails when we don't use latest_vulns?

[crozzy]

Just for a sanity check, did you check that the unit test you added fails when we don't use latest_vulns?

yes

[hdonnay]

Some nits that should be easy to knock out in a rebase.

LGTM after that.