ossf / osv-schema

Open Source Vulnerability schema.
https://ossf.github.io/osv-schema/
Apache License 2.0
176 stars 75 forks source link

Additional range types for versions conforming to the RPM and Debian versioning standards #252

Open andrewpollock opened 1 month ago

andrewpollock commented 1 month ago

Would it make sense to add additional range types for RPM and dpkg/Debian versioning standards?

The benefit being that the expectations and treatment of these ranges would be explicit.

References:

jasinner commented 3 weeks ago

Makes sense to me. A reference implementation of comparing RPM versions can be found in the RPM source code.

For clients using Go there is an implementation here: https://github.com/knqyf263/go-rpm-version

oliverchang commented 3 weeks ago

Hmm, the intention was that the ECOSYSTEM range would cover these. There are a lot of different versioning schemes out there, and we made the explicit decision to avoid having to catalogue all of these, particularly when they're tied to the underlying ecosystem already.