feat: error if modified date for existing advisories is ahead of the proposed modified date (#70)

Now that we're starting to generate advisories autonomously, it's
possible that local caches could get outdated meaning that regenerating
the advisories after doing a change could mistakenly revert advisory
updates or skip advisories that have since been published.

This introduces a check to help guard against that whereby we error if
the `modified` timestamp for the version of the advisory we've just
generated is behind the `modified` timestamp for the version of the
advisory that exists on disk which should be an indicator that the local
advisory cache is out of date.

I think this should be robust enough but I wouldn't be surprised if
there's an edge case or two that we discover later - I'm not really
worried about that though due to the utility of this check and worst
case you can just locally hardcode the function to return `False` as a
workaround.

Also just want to acknowledge we're technically opening the file twice
in a row but I found attempting to do this within the context of the
single file handler was a lot uglier since we have to account for the
advisory not existing ideally without suppressing if the file has
invalid JSON - in the scheme of things, the performance hit of doing a
double open will likely never be measurable 🤷

Author: G-Rath

scripts/generate_osv_advisories.py

@@ -420,6 +420,18 @@ def fetch_affected_packages(osv_advisory: osv.Vulnerability) -> list[str]:
   return [affected['package']['name'] for affected in osv_advisory['affected']]
 
 
+def is_existing_advisory_ahead(
+  name: str, sa_id: str, proposed_modified_at: str
+) -> bool:
+  try:
+    with open(f'advisories/{name}/D{sa_id}.json') as f:
+      existing_advisory = typing.cast(osv.Vulnerability, json.load(f))
+      # RFC3339 dates are designed to be comparable as strings, so this is safe
+      return existing_advisory['modified'] > proposed_modified_at
+  except FileNotFoundError:
+    return False
+
+
 def generate_osv_advisories() -> None:
   for file in os.scandir('cache/advisories'):
     if not file.is_file() or not file.name.endswith('.json'):
@@ -442,6 +454,12 @@ def generate_osv_advisories() -> None:
     for affected_package in affected_packages:
       name = affected_package.removeprefix('drupal/')
       os.makedirs(f'advisories/{name}', exist_ok=True)
+      if is_existing_advisory_ahead(name, sa_id, osv_advisory['modified']):
+        print(
+          ' \\- error: current modified date is ahead of the proposed modified date (is your cache up to date?)'
+        )
+        exit(1)
+
       with open(f'advisories/{name}/D{sa_id}.json', 'w') as f:
         json.dump(osv_advisory, f, indent=2)
         f.write('\n')