Skip to content

Commit 67f88a4

Browse files
orizerahorizerah
committed
add echo ecosystem
1 parent 6989ead commit 67f88a4

File tree

5 files changed

+39
-85
lines changed

5 files changed

+39
-85
lines changed

‎README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ This format is currently exported by:
88
- [Bitnami Vulnerability Database](https://github.com/bitnami/vulndb)
99
- [Chainguard](https://packages.cgr.dev/chainguard/osv/all.json)
1010
- [Curl](https://curl.se/docs/vuln.json)
11+
- [Echo](https://advisory.echohq.com/osv/all.json)
1112
- [GitHub Security Advisories](https://github.com/github/advisory-database)
1213
- [Global Security Database](https://github.com/cloudsecurityalliance/gsd-database)
1314
- [Go Vulnerability Database](https://github.com/golang/vulndb)

‎bindings/go/osvschema/constants.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ const (
1717
EcosystemCRAN Ecosystem = "CRAN"
1818
EcosystemCratesIO Ecosystem = "crates.io"
1919
EcosystemDebian Ecosystem = "Debian"
20+
EcosystemEcho Ecosystem = "Echo"
2021
EcosystemGHC Ecosystem = "GHC"
2122
EcosystemGitHubActions Ecosystem = "GitHub Actions"
2223
EcosystemGo Ecosystem = "Go"

‎docs/schema.md

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -245,6 +245,17 @@ The defined database prefixes and their "home" databases are:
245245
</ul>
246246
</td>
247247
</tr>
248+
<tr>
249+
<td><code>ECHO</code></td>
250+
<td><a href="https://advisory.echohq.com/osv/all.json">Echo Security Advisory Database</a></td>
251+
<td>
252+
<ul>
253+
<li>How to contribute: TBD</li>
254+
<li>Source URL: TBD</li>
255+
<li>OSV Formatted URL: <code>https://advisory.echohq.com/osv/&lt;ID&gt;.json</code></li>
256+
</ul>
257+
</td>
258+
</tr>
248259
<tr>
249260
<td><code>ELA</code></td>
250261
<td><a href="https://www.freexian.com/lts/extended/">Debian Extended LTS Security Advisories (provided by Freexian)</a></td>
@@ -789,6 +800,7 @@ The defined ecosystems are:
789800
| `CRAN` | The R package ecosystem. The `name` is an R package name. |
790801
| `crates.io` | The crates.io ecosystem for Rust; the `name` field is a crate name. |
791802
| `Debian` | The Debian package ecosystem; the `name` is the name of the source package. The ecosystem string might optionally have a `:<RELEASE>` suffix to scope the package to a particular Debian release. `<RELEASE>` is a numeric version specified in the [Debian distro-info-data](https://debian.pages.debian.net/distro-info-data/debian.csv). For example, the ecosystem string "Debian:7" refers to the Debian 7 (wheezy) release. |
803+
| `Echo` | The Echo package ecosystem; the `name` is the name of the source package. |
792804
| `GHC` | The Haskell compiler ecosystem. The `name` field is the name of a component of the GHC compiler ecosystem (e.g., compiler, GHCI, RTS). |
793805
| `GitHub Actions` | The GitHub Actions ecosystem; the `name` field is the action's repository name with owner e.g. `{owner}/{repo}`. |
794806
| `Go` | The Go ecosystem; the `name` field is a Go module path. |

‎ecosystems.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
"CRAN": "The R package ecosystem. The `name` is an R package name.",
1212
"crates.io": "The crates.io ecosystem for Rust; the `name` field is a crate name.",
1313
"Debian": "The Debian package ecosystem; the `name` is the name of the source package. The ecosystem string might optionally have a `:<RELEASE>` suffix to scope the package to a particular Debian release. `<RELEASE>` is a numeric version specified in the [Debian distro-info-data](https://debian.pages.debian.net/distro-info-data/debian.csv). For example, the ecosystem string \"Debian:7\" refers to the Debian 7 (wheezy) release.",
14+
"Echo": "The Echo package ecosystem; the `name` is the name of the source package.",
1415
"GHC": "The Haskell compiler ecosystem. The `name` field is the name of a component of the GHC compiler ecosystem (e.g., compiler, GHCI, RTS).",
1516
"GitHub Actions": "The GitHub Actions ecosystem; the `name` field is the action's repository name with owner e.g. `{owner}/{repo}`.",
1617
"Go": "The Go ecosystem; the `name` field is a Go module path.",

‎validation/schema.json

Lines changed: 24 additions & 85 deletions
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,7 @@
2121
"$ref": "#/$defs/timestamp"
2222
},
2323
"aliases": {
24-
"type": [
25-
"array",
26-
"null"
27-
],
24+
"type": ["array", "null"],
2825
"items": {
2926
"type": "string"
3027
}
@@ -51,10 +48,7 @@
5148
"$ref": "#/$defs/severity"
5249
},
5350
"affected": {
54-
"type": [
55-
"array",
56-
"null"
57-
],
51+
"type": ["array", "null"],
5852
"items": {
5953
"type": "object",
6054
"properties": {
@@ -71,10 +65,7 @@
7165
"type": "string"
7266
}
7367
},
74-
"required": [
75-
"ecosystem",
76-
"name"
77-
]
68+
"required": ["ecosystem", "name"]
7869
},
7970
"severity": {
8071
"$ref": "#/$defs/severity"
@@ -86,11 +77,7 @@
8677
"properties": {
8778
"type": {
8879
"type": "string",
89-
"enum": [
90-
"GIT",
91-
"SEMVER",
92-
"ECOSYSTEM"
93-
]
80+
"enum": ["GIT", "SEMVER", "ECOSYSTEM"]
9481
},
9582
"repo": {
9683
"type": "string"
@@ -99,9 +86,7 @@
9986
"title": "events must contain an introduced object and may contain fixed, last_affected or limit objects",
10087
"type": "array",
10188
"contains": {
102-
"required": [
103-
"introduced"
104-
]
89+
"required": ["introduced"]
10590
},
10691
"items": {
10792
"type": "object",
@@ -113,9 +98,7 @@
11398
"type": "string"
11499
}
115100
},
116-
"required": [
117-
"introduced"
118-
]
101+
"required": ["introduced"]
119102
},
120103
{
121104
"type": "object",
@@ -124,9 +107,7 @@
124107
"type": "string"
125108
}
126109
},
127-
"required": [
128-
"fixed"
129-
]
110+
"required": ["fixed"]
130111
},
131112
{
132113
"type": "object",
@@ -135,9 +116,7 @@
135116
"type": "string"
136117
}
137118
},
138-
"required": [
139-
"last_affected"
140-
]
119+
"required": ["last_affected"]
141120
},
142121
{
143122
"type": "object",
@@ -146,9 +125,7 @@
146125
"type": "string"
147126
}
148127
},
149-
"required": [
150-
"limit"
151-
]
128+
"required": ["limit"]
152129
}
153130
]
154131
},
@@ -169,9 +146,7 @@
169146
}
170147
},
171148
"then": {
172-
"required": [
173-
"repo"
174-
]
149+
"required": ["repo"]
175150
}
176151
},
177152
{
@@ -180,9 +155,7 @@
180155
"properties": {
181156
"events": {
182157
"contains": {
183-
"required": [
184-
"last_affected"
185-
]
158+
"required": ["last_affected"]
186159
}
187160
}
188161
}
@@ -192,20 +165,15 @@
192165
"properties": {
193166
"events": {
194167
"contains": {
195-
"required": [
196-
"fixed"
197-
]
168+
"required": ["fixed"]
198169
}
199170
}
200171
}
201172
}
202173
}
203174
}
204175
],
205-
"required": [
206-
"type",
207-
"events"
208-
]
176+
"required": ["type", "events"]
209177
}
210178
},
211179
"versions": {
@@ -224,10 +192,7 @@
224192
}
225193
},
226194
"references": {
227-
"type": [
228-
"array",
229-
"null"
230-
],
195+
"type": ["array", "null"],
231196
"items": {
232197
"type": "object",
233198
"properties": {
@@ -252,10 +217,7 @@
252217
"format": "uri"
253218
}
254219
},
255-
"required": [
256-
"type",
257-
"url"
258-
]
220+
"required": ["type", "url"]
259221
}
260222
},
261223
"credits": {
@@ -288,25 +250,18 @@
288250
]
289251
}
290252
},
291-
"required": [
292-
"name"
293-
]
253+
"required": ["name"]
294254
}
295255
},
296256
"database_specific": {
297257
"type": "object"
298258
}
299259
},
300-
"required": [
301-
"id",
302-
"modified"
303-
],
260+
"required": ["id", "modified"],
304261
"allOf": [
305262
{
306263
"if": {
307-
"required": [
308-
"severity"
309-
]
264+
"required": ["severity"]
310265
},
311266
"then": {
312267
"properties": {
@@ -341,6 +296,7 @@
341296
"CRAN",
342297
"crates.io",
343298
"Debian",
299+
"Echo",
344300
"GHC",
345301
"GitHub Actions",
346302
"Go",
@@ -377,7 +333,7 @@
377333
"type": "string",
378334
"title": "Currently supported ecosystems",
379335
"description": "These ecosystems are also documented at https://ossf.github.io/osv-schema/#affectedpackage-field",
380-
"pattern": "^(AlmaLinux|Alpaquita|Alpine|Android|BellSoft Hardened Containers|Bioconductor|Bitnami|Chainguard|ConanCenter|CRAN|crates\\.io|Debian|GHC|GitHub Actions|Go|Hackage|Hex|Kubernetes|Linux|Mageia|Maven|MinimOS|npm|NuGet|openEuler|openSUSE|OSS-Fuzz|Packagist|Photon OS|Pub|PyPI|Red Hat|Rocky Linux|RubyGems|SUSE|SwiftURL|Ubuntu|Wolfi|GIT)(:.+)?$"
336+
"pattern": "^(AlmaLinux|Alpaquita|Alpine|Android|BellSoft Hardened Containers|Bioconductor|Bitnami|Chainguard|ConanCenter|CRAN|crates\\.io|Debian|Echo|GHC|GitHub Actions|Go|Hackage|Hex|Kubernetes|Linux|Mageia|Maven|MinimOS|npm|NuGet|openEuler|openSUSE|OSS-Fuzz|Packagist|Photon OS|Pub|PyPI|Red Hat|Rocky Linux|RubyGems|SUSE|SwiftURL|Ubuntu|Wolfi|GIT)(:.+)?$"
381337
},
382338
"prefix": {
383339
"type": "string",
@@ -386,21 +342,13 @@
386342
"pattern": "^(ASB-A|PUB-A|ALSA|ALBA|ALEA|BELL|BIT|CGA|CURL|CVE|DSA|DLA|ELA|DTSA|GHSA|GO|GSD|HSEC|KUBE|LBSEC|LSN|MAL|MINI|MGASA|OESA|OSV|openSUSE-SU|PHSA|PSF|PYSEC|RHBA|RHEA|RHSA|RLSA|RXSA|RSEC|RUSTSEC|SUSE-[SRFO]U|UBUNTU|USN|V8)-"
387343
},
388344
"severity": {
389-
"type": [
390-
"array",
391-
"null"
392-
],
345+
"type": ["array", "null"],
393346
"items": {
394347
"type": "object",
395348
"properties": {
396349
"type": {
397350
"type": "string",
398-
"enum": [
399-
"CVSS_V2",
400-
"CVSS_V3",
401-
"CVSS_V4",
402-
"Ubuntu"
403-
]
351+
"enum": ["CVSS_V2", "CVSS_V3", "CVSS_V4", "Ubuntu"]
404352
},
405353
"score": {
406354
"type": "string"
@@ -466,22 +414,13 @@
466414
"then": {
467415
"properties": {
468416
"score": {
469-
"enum": [
470-
"negligible",
471-
"low",
472-
"medium",
473-
"high",
474-
"critical"
475-
]
417+
"enum": ["negligible", "low", "medium", "high", "critical"]
476418
}
477419
}
478420
}
479421
}
480422
],
481-
"required": [
482-
"type",
483-
"score"
484-
]
423+
"required": ["type", "score"]
485424
}
486425
},
487426
"timestamp": {

0 commit comments

Comments
 (0)