USNs notification service is sending emails to every revision uploader, even if the revision is not affected by the corresponding security notice

[Emilia Torino]

This was reported in the public forum https://forum.snapcraft.io/t/disabling-security-emails/32166/17

The issue here is that review-tools is adding to the pkg_db "uploaders" every revision "uploader_email" https://git.launchpad.net/review-tools/tree/reviewtools/store.py#n298 without checking first if the given revision was affected by the security notices: https://git.launchpad.net/review-tools/tree/reviewtools/store.py#n264.

Steps to reproduce: add a revision to ./tests/test-store-unittest-1.db which is not affected by the USNs in ./tests/test-usn-unittest-build-pkgs-only.db, and set the revision "uploader_email" to another person rather than the affected ones (e.g. <email address hidden>). Such collaborator will still receive the notification email but should not:

$ PYTHONPATH=./ ./bin/snap-updates-available --usn-db='./tests/test-usn-unittest-build-pkgs-only.db' --store-db='./tests/test-store-unittest-1.db'
From: Snap Store <email address hidden>
To: <affected revision uploader>, <email address hidden>
Bcc: <email address hidden>, <email address hidden>
Subject: 0ad was built with outdated Ubuntu packages

A scan of this snap shows that it was built with packages from the Ubuntu
archive that have since received security updates. The following lists new
USNs for affected build packages in each snap revision:

Revision r11 (amd64; channels: stable, candidate, beta)
 * snapcraft: 5501-1

Revision r12 (i386; channels: stable, candidate, beta)
 * snapcraft: 5501-1

Revision r13 (amd64; channels: edge)
 * snapcraft: 5501-1

Revision r14 (i386; channels: edge)
 * snapcraft: 5501-1

Revision r15 (amd64; channels: edge)
 * snapcraft: 5501-1

Revision r16 (i386; channels: edge)
 * snapcraft: 5501-1

Simply rebuilding the snap will pull in the new security updates and
resolve this. If your snap also contains vendored code, now might be a
good time to review it for any needed updates.

Thank you for your snap and for attending to this matter.

References:
 * https://ubuntu.com/security/notices/USN-5501-1/