Handle advisories which have related/same data

[TG1999]

We have advisories which are almost identical, also some kind of advisories which report different data but share same aliases and identifiers. And also sometime same advisory from the upstream gets updated. We need to handle all these cases.

• Same unique content ID, different AVIDs (same advisory) - We need to have a relationship to basically determine and assign primary and secondary advisory accordingly. We can decide it at creation time or have an improver
• Different content ID, shared aliases and identifiers: It could still be the same; what we need is specific improvers to know if it's a new or existing advisory. We can relate to these kind of advisories.

Beyond....

• Different content ID, same AVID (update): This is an update to the same advisory, which is processed using Plan storing of multiple advisories with same AVID #2068

[TG1999]

This issue details how we can relate and assign advisory ranks as primary/secondary. So for say if there are 6 advisories affecting a package. And a group of 3 are related together, and another 3 are related together. We will give 2 advisory sets. With ranks of advisories like primary and secondary per group. So consumer can show 2 primary advisories per group and user can see other advisories if they want. This issue is still under discussion and design phase.

[TG1999]

I have a question, imagine there are 3 advisories in total with these advisory IDs and aliases

Advisory 1 -
advisory ID - npm-101
alias - CVE-1

Advisory 2 -
advisory ID - CVE-1

Advisory 3-
advisory ID - GHSA-1
alias - CVE-1

And a package pkg:npm/foo/bar is reported to be affected by Advisory 1 and 3 only, so shall I send only Advisory 1 and Advisory 3 in response as a group or Advisory 1, Advisory 2 and Advisory 3 ?

[TG1999]

Tentative solution that we came up with discussion from @ziadhany @keshav-space @johnmhoran

[
affected_by :
  [
    {
      "related_advisories": ["Advisory-2"],
      "impacting_advisories" : ["Advisory-1", "Advisory-3"],
      "identifier": "CVE-1"
    }
  ]
]

So affected_by would be a list of AdvisorySets, each set will have "related_advisories" which are not directly impacting the package but may be related with the other advisories that are impacting it. And "impacting_advisories" that directly reports the package to be affected. Identifier will be the common shared alias/identifier between all those advisories.

[TG1999]

This is how advisories based on grouping on content looks like