fix: skip affected packages for "Not affected" Arch Linux AVGs

The Arch importer never looked at the AVG status, so records marked
"Not affected" were imported as affecting the listed packages. For
example AVG-2737 showed gnome-remote-desktop 42.1-1 as affected.

Keep the advisory so its aliases and references are still recorded,
but do not attach any affected packages to it.

Signed-off-by: Sahil Lenka <sahillenka44@gmail.com>

Author: Sahil-u07

vulnerabilities/pipelines/v2_importers/archlinux_importer.py

@@ -65,7 +65,11 @@ def parse_advisory(self, record) -> AdvisoryDataV2:
         summary = record.get("type", "")
         summary = "" if summary == "unknown" else summary
 
-        for name in record["packages"]:
+        packages = record["packages"]
+        if record.get("status") == "Not affected":
+            packages = []
+
+        for name in packages:
             affected = record.get("affected")
             fixed = record.get("fixed")
 

vulnerabilities/tests/pipelines/v2_importers/test_archlinux_importer_v2.py

@@ -28,3 +28,20 @@ def test_to_archlinux_advisories_v2(self):
         pipeline.response = data
         result = [adv.to_dict() for adv in pipeline.collect_advisories()]
         util_tests.check_results_against_json(result, expected_file)
+
+    def test_not_affected_avg_has_no_affected_packages(self):
+        record = {
+            "name": "AVG-2737",
+            "packages": ["gnome-remote-desktop"],
+            "status": "Not affected",
+            "severity": "Unknown",
+            "type": "unknown",
+            "affected": "42.1-1",
+            "fixed": "42.1.1-1",
+            "ticket": None,
+            "issues": ["CVE-2022-1736"],
+            "advisories": [],
+        }
+        advisory = ArchLinuxImporterPipeline().parse_advisory(record)
+        self.assertEqual(advisory.affected_packages, [])
+        self.assertEqual(advisory.aliases, ["CVE-2022-1736"])