Add support for affected_by_commits, fixed_by_commits, and OSV code fix commits

[ziadhany]

• Introduce affected_by_commits and fixed_by_commits fields in our advisory
• Update from_dict and to_dict methods
• Update compute_checksum method
• Create a CodeCommitData importer class
• Update OSV to collect code fix commits

[TG1999]

@ziadhany add description in the PR please!

[TG1999]

Why this? And what's the get_code_commit function ?

[ziadhany]

In the OSV schema, a commit be treated as the package version.
https://ossf.github.io/osv-schema/#python-vulnerability

"ranges": [ {
    "type": "GIT",
    "repo": "https://github.com/owner/repo",
    "events": [
      { "introduced": "X" },
      { "fixed": "Y" },
    ]
} ]

When importing this data into the new model, we currently log it as Unsupported fixed version type.
Instead, we should skip these entries silently to avoid unnecessary log noise, since they are already handled in the get_code_commit function.

[TG1999]

Why to skip and not create code commits out of these ?

[ziadhany]

Because the get_fixed_versions function returns only versions, I thought the name might be misleading.

No problem I’ll update it and rename get_fixed_versions to get_fixed_versions_and_commits

[TG1999]

@ziadhany mostly looks good! Please run the importer once and paste the logs here. Thanks!

I want to see if we are missing on any data in OSV format. And how does the AdvisoryData and ImpactedPackages looks with the new CommitData. Thanks!

[ziadhany]

@TG1999 This is the log output for the following importers:

• pysec_importer_v2
• pypa_importer_v2
• oss_fuzz_importer_v2

importers_logs.zip

the database query result :
vulnerabilities_advisory Total rows: 3262
vulnerabilities_impactedpackage_fixed_by_commits Total rows: 4013
vulnerabilities_impactedpackage_affecting_commits Total rows: 3623
vulnerabilities_codecommit Total rows: 3791