Rpmdb support

[cmaritan]

Address #254

[another-rex]

Thanks! Looks like a reasonable implementation to me, my main concern is pulling in the relatively large number of dependencies dependencies to parse the sqlite database., especially before any support for redhat advisories are included in osv.dev .

[G-Rath]

This looks cool! It would be good if you could have a look over the other parsers and consider if there's any situations they account for that should be handled for this parser/"lockfile" too, such as the same packages being listed multiple times

(I'm not super familiar with RedHat stuff, so it might all be being handled by the library)

[cmaritan]

Thanks! Looks like a reasonable implementation to me, my main concern is pulling in the relatively large number of dependencies dependencies to parse the sqlite database., especially before any support for redhat advisories are included in osv.dev .

Thanks for the feedback, I hadn't considered this point.

If it's a problem, we can surely keep aside this PR and merge it when osv.dev will have redhat advisories support.

[cmaritan]

This looks cool! It would be good if you could have a look over the other parsers and consider if there's any situations they account for that should be handled for this parser/"lockfile" too, such as the same packages being listed multiple times

(I'm not super familiar with RedHat stuff, so it might all be being handled by the library)

Usually rpmdb are written only by librpm, passing duplicates/invalid values should not be possible.
Generating this test case would require direct insert of records inside sqlite db but maintainers keep its structure undocumented so it's possible to break other things.

[andrewpollock]

Rocky Linux (currently present in OSV.dev) uses RPM and I'm not sure about Mageia, but it's in progress... It might be worthwhile getting this PR merged?

[another-rex]

I believe we can get rpmdb support with the osv-scalibr integration soon.

[picatz]

👋 Is there any status update on this PR? Would love to see this feature land.

[another-rex]

@picatz Still in progress and is being actively worked on, rough estimate is around the end of October, there should be some significant progress by then. We will be using the rpmdb support from the osv-scalibr project.

[picatz]

Awesome, I really appreciate the quick update @another-rex!

[jessesmd]

Please also consider the epoch related to rpm packages as they have a specific format epoch:name-version-release.arch
Thank you!