Write packages and vulnerabilities at the time of import

[TG1999]

public instance of VCIO contains more than 35 million advisories ( the volume is so high, due to minor changes in every advisory maybe sometime or the changes in models), which takes a lot of time. If we improve the advisories just after the import this will drop volume hugely.

[pombredanne]

Some nits for your consideration.

[pombredanne]

May be keeping the class design and passing kwargs can work too?

Suggested change

	def __init__(self, improver_class=None, improver: Improver = None):
	def __init__(self, improver_class, **kwargs):
	self.improver = improver_class(**kwargs)

[pombredanne]

This may be best in another PR

[TG1999]

@DennisClark we need your input on this, we use advisories as a screenshot of the status of the advisory at a given point of time. A single advisory goes through many improver processes to draw inferences, what should be the best possible way to get a status on advisory model to know which improvers have already ran through a particular advisory ?

[DennisClark]

@TG1999 Here are a few thoughts about advisories:

• every advisory should be associated with a "date_detected" (or similar), which can be the date+time that the advisory was originally posted to VC.
• since the number and types of potential improvers can vary, we may want to create a field (perhaps "associated_improvers") that can contain one or more pairs of improver_name:improver_date values, perhaps in a json structure or similar, that is updated whenever an improver is processed on the advisory
• alternatively, the new field would initially identify all the potential improver_name values with a null in the improver_date that is set when the improver is actually run for that advisory
• all of those new elements should be visible in the VCIO UI.
• the process(es) to initiate advisory improvements should select those where an appropriate improver has not yet been processed for that advisory.

I don't think we necessarily need a "status" on the advisory, since the list of improver_name:improver_date values ought to give us what would be really useful here (what has been run and when).

[TG1999]

@DennisClark thanks for these excellent suggestions.

[pombredanne]

Here are some nits for your consideration

[pombredanne]

Here are a few nits... Either apply now or later!
LGTM otherwise!

[pombredanne]

We are now using importer ... why still keeping the improver around in names of variables and objects?

[pombredanne]

Suggested change

	logger.info("Finished improving using %s.", advisory_importer.__class__.qualified_name)
	logger.info("Finished importing using %s.", advisory_importer.__class__.qualified_name)