When assigning an advisory ID, make sure the first reference is to advisory bug.

mga#13859

1 files changed, 12 insertions, 3 deletions

diff --git a/lib/MGA/Advisories.pm b/lib/MGA/Advisories.pm
index e56770d..62f9bee 100644
--- a/lib/MGA/Advisories.pm
+++ b/lib/MGA/Advisories.pm
@@ -183,9 +183,18 @@ sub assign_id {
     } else {
         # Advisories are not always just [0-9]+.adv, but are
         # sometimes [0-9]+.mga3.adv etc. so extract the real bug number
-        # Perhaps this should actually be the first bug from the advisory references?
-        my $bugnum = $advname;
-        $bugnum =~ s/[^0-9]//g;
+        my $advbugnum = $advname;
+        $advbugnum =~ s/[^0-9]//g;
+
+        if (scalar($adv->{references}) < 1) {
+            print STDERR "No reference links found in advisory\n";
+            return;
+        }
+        (my $bugnum) = $adv->{references}[0] =~ m/$config->{bugzilla_url}.*=([0-9]+)$/g;
+        if ($advbugnum ne $bugnum) {
+            print STDERR "First reference is not the corresponding Mageia advisory bug\n";
+            return;
+        }
 
         if (my $result = call_bz('Bug.get', {ids => [$bugnum]})) {
             my $failed = 0;