-
Notifications
You must be signed in to change notification settings - Fork 180
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Standardised formatting for OSV Schema #2135
Comments
Hi @yashrsharma44 , thanks for the issue! The For example, https://osv.dev/vulnerability/GHSA-9wmf-xf3h-r8pr is for the
Where every version listed is a version in the Where this is a bit more complicated is when there is no well-defined packaging ecosystem specified, like for general C/C++ libraries (i.e. there are only Does this answer your question? |
Additionally, thank you for your feedback, and if you have any data quality observations on the records (at https://storage.googleapis.com/osv-vulnerabilities/index.html?prefix=GIT/ in particular) please file issues to capture them. |
Thanks for the response. I agree with the versions returned; would be nice if we have this documented somewhere, ideally in the OSV Schema itself. The Thanks for maintaining this awesome archive 😄 |
My pleasure. I will add more GH issues, as I find any discrepancies in the data. |
Based on query raised in google/osv.dev#2135
Based on query raised in google/osv.dev#2135 Signed-off-by: Andrew Pollock <apollock@google.com>
@yashrsharma44 Please take a look at ossf/osv-schema#238 and provide any feedback on how well you feel it addresses this deficiency in the schema documentation. |
Based on query raised in google/osv.dev#2135 Signed-off-by: Andrew Pollock <apollock@google.com>
Based on query raised in google/osv.dev#2135 --------- Signed-off-by: Andrew Pollock <apollock@google.com>
Is your feature request related to a problem? Please describe.
I was playing with the feed in OSV database, and found that OSV.dev exports a feed of vulnerabilities for packages, which are enlisted in git repositories - https://storage.googleapis.com/osv-vulnerabilities/index.html?prefix=GIT/.
I wanted to understand, if the OSV schema has a standardised formatting for the versions entry, as I have found, some of the entries have versions formatted with - (1) prefix of
v
likev1.2.3
(2) some don't follow any SEMVER/other versioning standard (2) some contain tags from the github repositories.Describe the solution you'd like
A guideline on the standard for the versions should be quite helpful, in setting an expectation, and any details on the different types of version formatting we can expect as the users of the feed.
Describe alternatives you've considered
N/A as I am raising a feature request.
Additional context
N/A
Thanks for maintaining such an awesome feed!
The text was updated successfully, but these errors were encountered: