glvd: debsrc table contains binary package names for Garden Linux?

[fwilhe]

The 'debsrc' table should contain a list of source packages.

For example for source package expat this is what we have in the db for Debian trixie and bookworm:

The same should be the case for Garden Linux, but here the entries look like this:

This is an issue because matching of CVEs happens via source packages, so we won't be able to see any CVEs related to source package expat in Garden linux.

A test case for this issue is CVE-2024-45490.

In the table on the bottom of this screenshot, we should see Garden Linux versions, but we don't, because of this issue.

[fwilhe]

It looks like this is because for debian, glvd uses a different file type, coming from the apt-src section of the repo

example: The file is called deb.debian.org_debian_dists_trixie_main_source_Sources and has contents like this:

Package: expat
Binary: libexpat1-dev, libexpat1, libexpat1-udeb, expat
Version: 2.5.0-1

...

So the source package name is in the 'Package' field.

For Garden Linux we don't have that file (as far as I know), but a file like this one:

Package: libexpat1
Source: expat
Version: 2.6.2-1
Architecture: amd64
...

This file can be found here https://packages.gardenlinux.io/gardenlinux/dists/1592.1/main/binary-amd64/Packages.gz

So using the same parser for both files will work on first sight, but produce wrong results. We need to look for the Source statement instead for GL.