Repository: google/osv.dev

Issue:
Debian version exception
```
 File "/usr/local/bin/worker.py", line 531, in _do_process_task
    self._source_update(message)
  File "/usr/local/bin/worker.py", line 381, in _source_update
    self._do_update(source_repo, repo, vulnerability, path, original_sha256)
  File "/usr/local/bin/worker.py", line 458, in _do_update
    result = self._analyze_vulnerability(source_repo, repo, vulnerability,
  File "/usr/local/bin/worker.py", line 426, in _analyze_vulnerability
    result = osv.analyze(
  File "/env/osv/impact.py", line 492, in analyze
    enumerate_versions(affected_package.package.name,
  File "/env/osv/impact.py", line 400, in enumerate_versions
    current_versions = ecosystem.enumerate_versions(
  File "/env/osv/ecosystems.py", line 353, in enumerate_versions
    versions.sort(key=self.sort_key)
  File "/env/osv/ecosystems.py", line 336, in sort_key
    return DebianVersion.from_string(version)
  File "/env/osv/third_party/univers/debian.py", line 141, in from_string
    raise ValueError('Invalid version string: "{}"'.format(version))
ValueError: Invalid version string: "1:Beta2-2.1"
```


Discussion:
Another one:

```
"Unexpected exception while processing task: Traceback (most recent call last):
  File "/usr/local/bin/worker.py", line 535, in _do_process_task
    self._source_update(message)
  File "/usr/local/bin/worker.py", line 385, in _source_update
    self._do_update(source_repo, repo, vulnerability, path, original_sha256)
  File "/usr/local/bin/worker.py", line 462, in _do_update
    result = self._analyze_vulnerability(source_repo, repo, vulnerability,
  File "/usr/local/bin/worker.py", line 430, in _analyze_vulnerability
    result = osv.analyze(
  File "/env/osv/impact.py", line 492, in analyze
    enumerate_versions(affected_package.package.name,
  File "/env/osv/impact.py", line 390, in enumerate_versions
    sorted_events.sort(key=sort_key)
  File "/env/osv/impact.py", line 388, in sort_key
    return ecosystem.sort_key(event.fixed)
  File "/env/osv/ecosystems.py", line 337, in sort_key
    return DebianVersion.from_string(version)
  File "/env/osv/third_party/univers/debian.py", line 141, in from_string
    raise ValueError('Invalid version string: "{}"'.format(version))
ValueError: Invalid version string: "<end-of-life>"
```

Resolving patch:
diff --git a/osv/ecosystems.py b/osv/ecosystems.py
--- a/osv/ecosystems.py
+++ b/osv/ecosystems.py
@@ -15,6 +15,8 @@
 
 import bisect
 import json
+import logging
+
 import packaging.version
 import urllib.parse
 import requests
@@ -334,6 +336,10 @@ def __init__(self, debian_release_ver: str):
     self.debian_release_ver = debian_release_ver
 
   def sort_key(self, version):
+    if version == '<end-of-life>':
+      # End of life advisory means all versions can be affected
+      return DebianVersion(999999)
+
     return DebianVersion.from_string(version)
 
   def enumerate_versions(self, package, introduced, fixed, limits=None):
@@ -349,10 +355,19 @@ def enumerate_versions(self, package, introduced, fixed, limits=None):
       ) from ex
 
     response = json.loads(text_response)
-    versions: list[str] = [x['version'] for x in response['result']]
+    raw_versions: list[str] = [x['version'] for x in response['result']]
+
+    # Remove rare cases of unknown versions
+    def version_is_valid(v):
+      if not DebianVersion.is_valid(v):
+        logging.warning('Package %s has invalid version: %s', package, v)
+        return False
+      else:
+        return True
+
+    versions = [v for v in raw_versions if version_is_valid(v)]
     # Sort to ensure it is in the correct order
     versions.sort(key=self.sort_key)
-
     # The only versions with +deb
     versions = [
         x for x in versions


Test patch:
diff --git a/osv/ecosystems_test.py b/osv/ecosystems_test.py
--- a/osv/ecosystems_test.py
+++ b/osv/ecosystems_test.py
@@ -113,6 +113,9 @@ def test_debian(self, requests_mock: mock.MagicMock):
     self.assertGreater(
         ecosystem.sort_key('1.13.6-2'), ecosystem.sort_key('1.13.6-1'))
 
+    self.assertGreater(
+        ecosystem.sort_key('<end-of-life>'), ecosystem.sort_key('1.13.6-1'))
+
     # Test Ecosystem remover
     ecosystem = ecosystems.get('Debian:10')
     # '0' as introduced version also tests the get_first_package_version func