Handle removed CPEs and CVEs in SCAP sync

[mattmundell]

Checklist:

• Tests
• CHANGELOG Entry

[timopollmeier]

This looks okay overall but unless I'm missing something this doesn't remove affected products that were removed from CVEs that are still in the XML.

I also wonder if using a temporary table or other data structure instead of buffering an array literal wouldn't be a better idea, especially when the CPEs from CVEs could have some redundancy.

[mattmundell]

This looks okay overall but unless I'm missing something this doesn't remove affected products that were removed from CVEs that are still in the XML.

This is done by the changes to insert_cve_products in 2879642.

It collects all affected products for the CVE in initial_affected, then removes the CPEs from init_affected as they are encountered. At the end it removes any that remain.

Or do you mean something else?

[mattmundell]

I also wonder if using a temporary table or other data structure instead of buffering an array literal wouldn't be a better idea, especially when the CPEs from CVEs could have some redundancy.

I wanted to avoid the SQL queries that would be required for a temporary table. Apparently the ANY(array...) will be converted to a temporary table by Postgres anyway.

I don't think duplicates will be a problem. The list should be small. (Admittedly a small list mean using SQL queries to fill a temporary table may not be a problem.)

[timopollmeier]

Sorry, looks like I got CVEs and CPEs confused in some places when I first read this PR.

Having all the CVE-IDs in a single literal still seems kind of long, but as long as there are also no problems with reallocating the memory for the string that often, it should be fine.