Update Ubuntu package matching behavior

[another-rex]

OSV-Scanner currently can only reliably get Ubuntu ecosystems with their release number (e.g. Ubuntu:22.04), but cannot get whether it is of the :LTS or :Pro variant without some vague string parsing.

Is there a difference in packages between Ubuntu:22.04 and Ubuntu:22.04:LTS at the same version number? E.g. is socat at version 1.7.4.1-3ubuntu1 the same between Ubuntu:22.04 and the LTS?

If they are the same, for our API, it should be fine to strip :LTS when matching, so a query with ecosystem of Ubuntu:22.04 and Ubuntu:22.04:LTS will return the same results.

Also does a similar thing apply the :Pro variant as well.

@dodys might you be able to provide some answers here? :)

[dodys]

@another-rex what you are referring to Ubuntu:22.04 is actually Ubuntu:22.04:LTS, we have no data that would have only Ubuntu:22.04, so I don't understand the difference you are seeing.

The :Pro variant is indeed an extra, as it is packages that don't go to the normal archive.

[another-rex]

Thanks for the quick reply! It seems I misunderstood how Ubuntu releases work. I was assuming that a release starts off not marked as LTS and then becomes LTS, but it looks like LTS releases are started as LTS releases from the beginning, so this makes sense now.

For the :Pro variants, if we found a package matching the version specified on a advisory (e.g. [email protected]+dfsg-6 from https://osv.dev/vulnerability/UBUNTU-CVE-2024-53863), on an Ubuntu:18.04 machine/image (unknown whether it is Pro or not), can we assume that the advisory applies to that package?

[dodys]

@another-rex sorry for the late reply, I was out the previous days.

Pro is a bit trickier, therefore I will try to list every case below:

1. Pro only exists for LTS releases, therefore Interim releases like 25.10, there's no Pro variant.
2. For LTS releases that have already passed their 5 years of support, like 14.04, 16.04 and 18.04, you might see either the LTS or the Pro variant:
   2.1. The LTS variant if the fix was published publicly;
   2.2 The Pro variant if the fix was published under Pro (only for universe packages) or if there's no fix available yet (that's the case with the matrix-synapse CVE you mentioned for 18.04).
3. For LTS releases that are still in their LTS period (within the 5 years of support), like 20.04, 22.04 and 24.05, you might also see either the LTS or the Pro variant:
   3.1. The LTS variant if the fix was published publicly or if there's no fix available yet;
   3.2. The Pro variant if the fix was published under Ubuntu Pro (only for universe packages).

Nevertheless, to answer your question, the package is the same in LTS or Pro, the only change is the version and the patches that were applied to it. Therefore on a Ubuntu:18.04 you can assume that the advisory applies to that package.

Let me know if it makes sense or if you have any other doubts.