feat: Intgrate CPE library for robust hardware filtering

nix/overlay.nix

@@ -11,6 +11,19 @@ in
   python3 = prev.python3.override {
     packageOverrides = pyfinal: _pyprev: {
       django = pyfinal.django_5;
+      cpe = pyfinal.buildPythonPackage rec {
+        pname = "cpe";
+        version = "1.3.1";
+        pyproject = true;
+        build-system = [
+          pyfinal.setuptools
+        ];
+        src = pyfinal.fetchPypi {
+          inherit pname version;
+          sha256 = "sha256-8wqXiBtut0ptYwVSrrzgPfIs3belh9YyoTtOFLZrlbA=";
+        };
+        doCheck = false;
+      };
     };
   };
   # go through the motions to make a flake-incompat project use the build
@@ -66,6 +79,7 @@ in
       pytest-playwright
       pytest-mock
       cvss
+      cpe
       freezegun
       django-model-utils
     ];

src/shared/listeners/automatic_linkage.py

@@ -1,13 +1,12 @@
 import logging
 
 import pgpubsub
+from cpe import CPE
 from django.conf import settings
 from django.db.models import (
     Case,
-    Exists,
     F,
     IntegerField,
-    OuterRef,
     Q,
     Value,
     When,
@@ -16,7 +15,7 @@
 from django.db.models.functions import RowNumber
 
 from shared.channels import ContainerChannel
-from shared.models.cve import Container, Cpe
+from shared.models.cve import Container
 from shared.models.linkage import CVEDerivationClusterProposal, ProvenanceFlags
 from shared.models.nix_evaluation import (
     NixDerivation,
@@ -43,15 +42,22 @@ def produce_linkage_candidates(
         .filter(row_num=1)
     )
 
-    # FIXME(@fricklerhandwerk): se a proper parsing library such as https://github.com/nilp0inter/cpe to work on structured data.
-    # That particular one looks like the best candidate, but appears unmaintained (or could just be very stable); needs thorough review before adopting it.
-    has_any_cpe = Exists(Cpe.objects.filter(affectedproduct=OuterRef("pk")))
-    has_non_hardware_cpe = Exists(
-        Cpe.objects.filter(affectedproduct=OuterRef("pk")).exclude(
-            name__istartswith="cpe:2.3:h:"
-        )
-    )
-    filtered_affected = container.affected.exclude(has_any_cpe & ~has_non_hardware_cpe)
+    def is_hardware(cpe_str: str) -> bool:
+        try:
+            return CPE(cpe_str).is_hardware()
+        except (NotImplementedError, ValueError):
+            return cpe_str.startswith(("cpe:2.3:h:", "cpe:/h:"))
+
+    # Filter out affected products that are only identified by hardware CPEs.
+    affected_products = container.affected.prefetch_related("cpes")
+    to_exclude = [
+        affected.pk
+        for affected in affected_products
+        if (cpes := affected.cpes.all())
+        and all(is_hardware(cpe_obj.name) for cpe_obj in cpes)
+    ]
+
+    filtered_affected = container.affected.exclude(pk__in=to_exclude)
 
     package_names = (
         filtered_affected.exclude(package_name__isnull=True)