Implement multiple archiving intervals (0, 3, 10, 30, 90 days)

[mprpic]

Archive CVE references of a CVE record at five defined intervals: 0 days, 3 days, 10 days, 30 days, and 90 days after CVE Record publication. Currently, the system only supports single archival requests without interval scheduling.

Requirements:

• Modify job scheduling to support multiple intervals per CVE
• Update database schema to track archival intervals
• Implement automated scheduling for 0, 3, 10, 30, and 90-day intervals
• Update CVE processor to handle interval-based archival
• Add configuration to enable/disable specific intervals

Acceptance Criteria:

• CVE submission creates 5 separate scheduled jobs (0, 3, 10, 30, 90 days)
• Database tracks which interval each archive belongs to
• System automatically executes archival at each interval
• Failed interval archival doesn't block subsequent intervals

[dwelch2344]

Questions

• CVE submission creates 5 separate scheduled jobs (0, 3, 10, 30, 90 days)

1. Is a submission a CVE creation? Modification? Both?
2. How do we track this? Polling?

Notes

• Update CVE processor to handle interval-based archival
  We actually have this for free already.

• When a CVE is queued, we can immediately calculate the "start times" in the future and queue jobs which will patiently wait to be processed.
• Where things may get sticky is in the book keeping. If an update comes along to the CVE (and assuming we re-index changes) we'd probably want to cancel the original pending archivals, and then reschedule. Yes?

• Add configuration to enable/disable specific intervals
  Let's codify them in a YAML config file that even non-technical people could PR to (at which point a merge to main means CI/CD will roll out changes automatically)

Actions

Most of this should be good to go for initial reqs. Outstanding tasks are:

• Database tracks which interval each archive belongs to (minimal effort)
• Schedule (and associate) interval-based jobs
• Add configuration to enable/disable specific intervals (minimal effort)

What should probably also be considered:

• Manage pending archival jobs
• Ability to query/manage/reschedule jobs

[dwelch2344]

From discussion today:

Is a submission a CVE creation? Modification? Both?

• A newly published CVE; starts the interval timeline
• When a update happens:
  • Qualified Update: resets time (products, references, score, etc). Reset Interval
  • Unqualified: we don't care so just archive once. Don't Reset Interval
  • Irrelevant: don't even archive or reset interval. Don't do anything
• We probably default to Qualified, until data determines how to cut back.

How do "trigger"?

• CVE Services webhook - is it feasible?
• Poll the CVEListV5 diff file

Questions

1. How many updates occur in a given week?
   • is this data available? (snapshot from logs)