search

google / osv.dev

Open source vulnerability DB and triage service.
https://osv.dev
Apache License 2.0
1.52k stars 188 forks source link

Support Maven registries in OSV entries #2088

Open oliverchang opened 7 months ago

oliverchang commented 7 months ago

https://github.com/ossf/osv-schema/pull/231 was just merged, which adds optional Maven registries to the Maven ecosystem:

i.e.

      "package": {
        "ecosystem": "Maven:https://mycoolregistry.com",
        "name": "io.netty:netty-handler"
      },

There are some additional considerations to be made here for our matching logic:

The default assumed registry is https://repo.maven.apache.org/maven2 (and perhaps other common variants/mirrors?). API queries must take this into account, with {"ecosystem": "Maven"} and {"ecosystem": "Maven:https://repo.maven.apache.org/maven2"} both matching against OSV entries with either formatting. We may want to just normalize Maven ecosystems on ingestion to strip the Maven central URL if it is provided.

Unlike with other Linux distros queries, where {"ecosystem": "Debian"} matches against OSV entries with {"ecosystem": "Debian:<anything>"}, API queries specifying {"ecosystem": "Maven"} should not match against all registries. It should default to Maven Central per above.

github-actions[bot] commented 3 months ago

This issue has not had any activity for 60 days and will be automatically closed in two weeks

github-actions[bot] commented 1 month ago

This issue has not had any activity for 60 days and will be automatically closed in two weeks

See https://github.com/google/osv.dev/blob/master/CONTRIBUTING.md for how to contribute a PR if you're interested in helping out.