dev-cmd/generate-vulns-advisories: OSV advisory export for homebrew-advisory-database#23106
Merged
Conversation
Ports the OSV record exporter from Homebrew/homebrew-brew-vulns. Emits one BREW-<formula>-<CVE> record per security id declared in a formula's patch resolves list, under the registered Homebrew ecosystem with pkg:brew purls, marking the currently shipped pkg_version as the fixed boundary. Upstream summary/severity/references are copied from OSV.dev where available. This is the generator for Homebrew/homebrew-advisory-database; the dev-cmd entry point follows in the next commit.
Replaces the tap's brew-vulns --osv-export DIR with a hidden dev-cmd following the generate-formula-api pattern. Iterates homebrew/core under with_no_api_env + SimulateSystem, unions each formula's serialized_patches across all OS/arch variations from to_hash_with_variations so platform-gated resolves annotations are not silently dropped, and hands [formula, patches] pairs to Homebrew::Vulns::OsvExport. --dry-run lists record ids without writing or querying OSV.dev. Consumed by Homebrew/homebrew-advisory-database's regenerate workflow.
33 tasks
andrew
added a commit
to Homebrew/homebrew-brew-vulns
that referenced
this pull request
Jul 14, 2026
The exporter now lives in Homebrew/brew as a dev-cmd (Homebrew/brew#23106) feeding Homebrew/homebrew-advisory-database, so split it out from the "not available" list.
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adds a hidden developer command to generate OSV-schema advisory records for the Homebrew ecosystem from homebrew/core formula patch resolves annotations, enabling Homebrew/homebrew-advisory-database to build its BREW-* feed without the deprecated tap gem.
Changes:
- Introduces
Homebrew::Vulns::OsvExportto build/write OSV 1.7 records per (formula, vulnerability id) pair, optionally enriching from OSV.dev. - Adds
brew generate-vulns-advisories DIR(hidden dev-cmd) that loads core formulae underSimulateSystemand unions patch annotations across OS/arch variations. - Adds unit tests, Sorbet RBI for args, and updates shell completions to expose the new dev command for developers.
Reviewed changes
Copilot reviewed 7 out of 8 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| Library/Homebrew/vulns/osv_export.rb | Implements OSV record generation + writing and upstream enrichment. |
| Library/Homebrew/dev-cmd/generate-vulns-advisories.rb | Adds hidden dev-cmd to enumerate core formulae, union variation patches, and invoke exporter (or --dry-run). |
| Library/Homebrew/test/vulns/osv_export_spec.rb | Unit tests for record shape, patch filtering, purl encoding, and upstream merge behavior. |
| Library/Homebrew/test/dev-cmd/generate-vulns-advisories_spec.rb | Unit tests for the command’s generation behavior, --dry-run, and variation patch unioning. |
| Library/Homebrew/sorbet/rbi/dsl/homebrew/dev_cmd/generate_vulns_advisories.rbi | Tapioca-generated RBI for args accessors (dry_run?, n?). |
| completions/zsh/_brew | Adds zsh completion entry/function for the new dev command. |
| completions/fish/brew.fish | Adds fish completion entry/flags for the new dev command. |
| completions/bash/brew | Adds bash completion wiring and developer-command list entry. |
Files not reviewed (1)
- Library/Homebrew/sorbet/rbi/dsl/homebrew/dev_cmd/generate_vulns_advisories.rbi: File type not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
When multiple formulae resolve the same CVE, fetch it from OSV.dev once per run rather than once per (formula, id) pair. Uses Hash#fetch with a block so a nil (fetch-failed) result is also cached.
MikeMcQuaid
reviewed
Jul 14, 2026
Add a pointer to ossf.github.io/osv-schema above SCHEMA_VERSION and note where the Homebrew ecosystem/prefix were registered. patch_ref now returns T::Hash[Symbol, T.any(String, T::Array[String])] via a PatchRef alias; the input side stays T.untyped to match Formula#serialized_patches.
3 tasks
MikeMcQuaid
approved these changes
Jul 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #23080. Ports the OSV-record exporter from Homebrew/homebrew-brew-vulns as a hidden dev-cmd so Homebrew/homebrew-advisory-database can generate its
BREW-*advisory feed without depending on the deprecated tap gem.brew generate-vulns-advisories DIRiterateshomebrew/coreunderSimulateSystem, collects each formula'sserialized_patchesunioned across every OS/arch variation fromto_hash_with_variations(so aresolvesinsideon_linux/on_intelis not silently dropped), and writes one OSV 1.7 record per (formula, security id) pair. Upstream summary/severity/references are copied from OSV.dev where available.--dry-runlists the record ids without writing or querying the network.The record generator itself lives in
Homebrew::Vulns::OsvExport, reusingScanner.resolved_idsand theOSVclient from #23080.pkg:brewpurls percent-encode@and+in formula names.A
--dry-runagainst currenthomebrew/coreproduces the same 5 formulae as the existing advisory tree (glibc,libquicktime,lrzsz,unzip,zip) plus 6 additionallibquicktimeCVEs annotated since the last regenerate on 2026-06-28. TheHomebrewecosystem,BREW-prefix andpkg:brewpurl type are now registered (ossf/osv-schema#576, package-url/purl-spec#796).Background and migration plan: Homebrew/homebrew-brew-vulns#111, Homebrew/discussions#6869.
brewcommands to reproduce the bug?brew lgtm(style, typechecking and tests) locally?Ported with Claude Code from
lib/brew/vulns/osv_export.rbin the tap, with a review pass from codex on each commit. I read both diffs, ranbrew lgtm, and diffed a--dry-runagainst the current advisory database.