Improve recipe advisory coverage and report non-CVE fixes

cc-ci-plan/audit-sources.py

@@ -134,7 +134,7 @@ def security_source_audit(recipe: str) -> list[dict]:
         e = A.nvd_advisories(cpe, key)
         n = len(e.get("advisories") or [])
         out.append({"source": e["source"] + f"  ({cpe.split(':')[4]}/{cpe.split(':')[3]})",
-                    "kind": "advisory-feed" if n else "no-cve-data",
+                    "kind": "advisory-feed", "verified_empty": n == 0,
                     "status": e["status"], "cves": n, "usable": n})
     for entry in A.github_advisories(urls):
         out.append({"source": entry["source"], "kind": "advisory-feed",
@@ -227,18 +227,7 @@ def audit_recipe(recipe: str, ssh: str | None, quiet_days: int) -> dict:
 
 
 def _registry_urls(recipe: str):
-    path = os.path.join(REGISTRY_DIR, f"{recipe}.md")
-    if not os.path.exists(path):
-        return [], None
-    text = open(path).read()
-    urls = []
-    for u in re.findall(r"https?://[^\s)|\]]+", text):
-        u = u.rstrip("`'\"*.,;:>)")
-        if "…" in u or "..." in u:
-            continue
-        if u and u not in urls:
-            urls.append(u)
-    return urls, path
+    return A.registry_urls(recipe, REGISTRY_DIR)
 
 
 def all_recipes() -> list[str]:
@@ -274,7 +263,8 @@ def main() -> int:
         blind_recipes, noisy = [], 0
         for r in recipes:
             rows = security_source_audit(r)
-            feeds = [x for x in rows if x["kind"] == "advisory-feed" and x["cves"] > 0
+            feeds = [x for x in rows if x["kind"] == "advisory-feed"
+                     and (x["cves"] > 0 or x.get("verified_empty"))
                      and x["status"] == "ok"]
             logs = [x for x in rows if x["kind"] == "changelog" and x["status"] == "ok"]
             unattr = [x for x in rows if x["kind"] == "unattributable"]
@@ -286,13 +276,16 @@ def main() -> int:
                 print(f"!! {r}: NO VERIFIED CVE SOURCE — {len(unattr)} unparseable page(s), "
                       f"0 populated advisory feeds, 0 attributable changelogs, {len(failed)} failed source(s)")
                 for x in rows:
-                    print(f"      {x['kind']:15} {x['source'][:64]} ({x['cves']} CVEs; {x['status']})")
+                    unit = "advisories" if x["kind"] == "advisory-feed" else "CVE IDs"
+                    print(f"      {x['kind']:15} {x['source'][:64]} ({x['cves']} {unit}; {x['status']})")
             else:
                 print(f"OK {r}: {len(feeds)} advisory-feed(s), {len(logs)} changelog(s)"
                       + (f", {len(unattr)} unparseable page(s)" if unattr else "")
                       + (f", {len(failed)} failed source(s) — counts incomplete" if failed else ""))
                 for x in logs:
                     print(f"      changelog  {x['source'][:62]} ({x['usable']}/{x['cves']})")
+                for x in failed:
+                    print(f"      FAILED     {x['source'][:90]} ({x['status']})")
         print(f"\n{len(recipes)} recipes · {len(blind_recipes)} with NO usable CVE source"
               + (f": {', '.join(blind_recipes)}" if blind_recipes else "")
               + f" · {noisy} unparseable page(s) elsewhere (harmless where a feed covers them)")