Import of Debian and Ubuntu packages ignores status field

[lohani2280]

While going through the debian security tracker data, I noticed that it contains fixed_version data. But in the data_dump file the mappings are created in the ImpactedReference table. See here https://github.com/nexB/vulnerablecode/blob/55a633db3c09d8b78d21bffea25a510e1444acdf/vulnerabilities/data_dump.py#L46. But logically it should be ResolvedReference table.

[puneeth-chanda]

@lohani2280 I guess that this is the same case in ubuntu and archlinux packages also, can you please check it once.

[haikoschol]

Whether a record from a security tracker is stored as ImpactedPackage or ResolvedPackage should be decided based on the status field, or other fields that imply the status.

For Archlinux, the code looks fine. However, if a record does not include a version in the fixed attribute, a Package is stored with version None. This is probably not useful and should be addressed in a separate issue.

For Debian and Ubuntu, the import code only stores ImpactedPackage without considering the status field.