Change: Assume UTC when no offset it specified

[n-thumann]

What

This PR changes the behavior of handling datetime objects. Instead of assuming the local timezone, we should assume UTC instead.

Why

NVD always returns datetime objects in UTC, so we should mark them as those. The only documentation, I've found regarding this is datetime objects in the API response are always returned with a zero offset from UTC (see https://nvd.nist.gov/general/news/api-20-announcements).

Example:

➜  ~ curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2022-45536" | jq ".vulnerabilities[0].cve.published"
"2022-11-22T21:15:11.103"

Current behavior:

➜  pontos git:(main) poetry run python            
Python 3.10.12 (main, Nov 20 2023, 15:14:05) [GCC 11.4.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> from pontos.nvd.cve import CVEApi
>>> import asyncio
>>> from datetime import timezone
>>> async def foo(id):
...     async with CVEApi() as api:
...             return await api.cve(id)
... 
>>> asyncio.run(foo("CVE-2022-45536")).published
datetime.datetime(2022, 11, 22, 21, 15, 11, 103000)
>>> asyncio.run(foo("CVE-2022-45536")).published.timestamp()
1669148111.103

With this patch:

➜  pontos git:(assume_utc) poetry run python
Python 3.10.12 (main, Nov 20 2023, 15:14:05) [GCC 11.4.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> from pontos.nvd.cve import CVEApi
>>> import asyncio
>>> from datetime import timezone
>>> async def foo(id):
...     async with CVEApi() as api:
...             return await api.cve(id)
... 
>>> asyncio.run(foo("CVE-2022-45536")).published
datetime.datetime(2022, 11, 22, 21, 15, 11, 103000, tzinfo=datetime.timezone.utc)
>>> asyncio.run(foo("CVE-2022-45536")).published.timestamp()
1669151711.103

References

The LoC form this PR have been first added in 2e397c3.

Checklist

• Tests

[github-actions]

Conventional Commits Report

Type	Number
Bug Fixes	1
Changed	1

🚀 Conventional commits found.