vex: skip source RPM archs for fixed and known_not_affected

Ignore src/nosrc when building vulnerabilities so they do not
overwrite empty archs from binary entries that share an arch-agnostic
status key.

Signed-off-by: crozzy <joseph.crosland@gmail.com>

Author: crozzy

rhel/vex/parser.go

@@ -920,6 +920,12 @@ func (c *creator) fixedVulnerabilities(ctx context.Context, v *csaf.Vulnerabilit
 		if err != nil {
 			return nil, err
 		}
+		// Skip source RPMs: they share a Key with no-arch binary siblings when
+		// arch is ignored, and would otherwise set Arch=src (no binary match)
+		// or, if ignored in extractArch, emit duplicate binary vulns.
+		if isSourceArch(st.PURL) {
+			continue
+		}
 
 		key := st.Key()
 		vuln, created := lookup(key)
@@ -1031,6 +1037,9 @@ func (c *creator) knownNotAffectedVulnerabilities(ctx context.Context, v *csaf.V
 		if err != nil {
 			return nil, err
 		}
+		if isSourceArch(st.PURL) {
+			continue
+		}
 
 		key := st.Key()
 		vuln, created := lookup(key)
@@ -1348,3 +1357,11 @@ func extractArch(p *packageurl.PackageURL) string {
 		return arch
 	}
 }
+
+// IsSourceArch reports whether the pURL names a source RPM (arch=src/nosrc).
+// Those are not installable binary arches and must not create or reshape
+// binary-package vulnerabilities.
+func isSourceArch(p *packageurl.PackageURL) bool {
+	arch, _ := qualifier(p, "arch")
+	return arch == "src" || arch == "nosrc"
+}

rhel/vex/parser_test.go

@@ -380,20 +380,20 @@ func TestParse(t *testing.T) {
 		{
 			name:            "cve-2022-1705",
 			filenames:       []string{"testdata/cve-2022-1705.json"},
-			expectedVulns:   2009,
+			expectedVulns:   1641,
 			expectedDeleted: 0,
 		},
 		{
 			name:             "cve-2024-24786",
 			filenames:        []string{"testdata/cve-2024-24786.json"},
-			expectedVulns:    1837,
+			expectedVulns:    1764,
 			expectedDeleted:  0,
 			expectedAncestry: 732,
 		},
 		{
 			name:            "cve-2022-38752",
 			filenames:       []string{"testdata/cve-2022-38752.json"},
-			expectedVulns:   1788,
+			expectedVulns:   1494,
 			expectedDeleted: 0,
 		},
 		{
@@ -405,13 +405,13 @@ func TestParse(t *testing.T) {
 		{
 			name:            "cve-2024-24786-new-module-format",
 			filenames:       []string{"testdata/cve-2024-24786-1.json"},
-			expectedVulns:   2731,
+			expectedVulns:   2661,
 			expectedDeleted: 0,
 		},
 		{
 			name:            "cve-2023-38545",
 			filenames:       []string{"testdata/cve-2023-38545.json"},
-			expectedVulns:   269,
+			expectedVulns:   265,
 			expectedDeleted: 0,
 		},
 		{
@@ -828,3 +828,67 @@ func TestDocLinkFromBase(t *testing.T) {
 		t.Fatalf("nil base: got %q, want empty", got)
 	}
 }
+
+func TestExtractArch(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name string
+		purl packageurl.PackageURL
+		want string
+	}{
+		{
+			name: "no arch",
+			purl: packageurl.PackageURL{Type: packageurl.TypeRPM, Namespace: "redhat", Name: "binutils", Version: "2.45.1-5.1.hum1"},
+			want: "",
+		},
+		{
+			name: "x86_64",
+			purl: packageurl.PackageURL{
+				Type: packageurl.TypeRPM, Namespace: "redhat", Name: "binutils", Version: "2.45.1-5.1.hum1",
+				Qualifiers: packageurl.QualifiersFromMap(map[string]string{"arch": "x86_64"}),
+			},
+			want: "amd64|x86_64",
+		},
+		{
+			name: "aarch64",
+			purl: packageurl.PackageURL{
+				Type: packageurl.TypeRPM, Namespace: "redhat", Name: "binutils", Version: "2.45.1-5.1.hum1",
+				Qualifiers: packageurl.QualifiersFromMap(map[string]string{"arch": "aarch64"}),
+			},
+			want: "aarch64",
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got := extractArch(&tc.purl)
+			if got != tc.want {
+				t.Fatalf("got %q, want %q", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestIsSourceArch(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name string
+		arch string
+		want bool
+	}{
+		{name: "empty", arch: "", want: false},
+		{name: "x86_64", arch: "x86_64", want: false},
+		{name: "src", arch: "src", want: true},
+		{name: "nosrc", arch: "nosrc", want: true},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			p := &packageurl.PackageURL{Type: packageurl.TypeRPM, Name: "binutils"}
+			if tc.arch != "" {
+				p.Qualifiers = packageurl.QualifiersFromMap(map[string]string{"arch": tc.arch})
+			}
+			if got := isSourceArch(p); got != tc.want {
+				t.Fatalf("got %v, want %v", got, tc.want)
+			}
+		})
+	}
+}