Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 16 additions & 12 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,16 +1,19 @@
# OSV - Open Source Vulnerabilities

OSV is a [vulnerability database] and triage infrastructure for open source
projects aimed at helping both open source maintainers and consumers of open
source.
[osv.dev] is a [vulnerability database] and triage infrastructure for
open source projects aimed at helping both open source maintainers and
consumers of open source.

For open source maintainers, OSV's automation helps reduce the burden of triage.
Each vulnerability undergoes automated bisection and impact analysis to
determine precise affected commit and version ranges.
This repository contains the infrastructure code that serves [osv.dev]
(and other user tooling). This infrastructure serves as an aggregator of
vulnerability databases that have adopted the
[OpenSSF Vulnerability format](https://github.com/ossf/osv-schema).

For open source consumers, OSV provides an API that lets users of these projects
query whether or not their versions are impacted.
[osv.dev] additionally provides infrastructure to ensure affected
versions are accurately represented in each vulnerability entry, through
bisection and version analysis.

[osv.dev]: https://osv.dev
[vulnerability database]: https://osv.dev/list

<p align="center">
Expand All @@ -19,9 +22,9 @@ query whether or not their versions are impacted.

## Current data sources
**This is an ongoing project.** We encourage open source ecosystems to adopt
the [OpenSSF Vulnerability format](https://github.com/ossf/osv-schema) for the
benefit of the open source community. See our
[blog post](https://security.googleblog.com/2021/06/announcing-unified-vulnerability-schema.html)
the [OpenSSF Vulnerability format](https://github.com/ossf/osv-schema) to enable
open source users to easily aggregate and consume vulnerabilities across all ecosystesm.
See our [blog post](https://security.googleblog.com/2021/06/announcing-unified-vulnerability-schema.html)
for more details.

The following ecosystems have vulnerabilities encoded in this format:
Expand Down Expand Up @@ -72,7 +75,8 @@ You can find an overview of OSV's architecture [here](docs/architecture.md).

## This repository

This repository contains all the code for running OSV on GCP. This consists of:
This repository contains all the code for running https://osv.dev on GCP. This
consists of:

- API server (`gcp/api`)
- Web interface (`gcp/appengine`)
Expand Down
Binary file modified docs/images/diagram.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
20 changes: 11 additions & 9 deletions gcp/appengine/frontend/src/components/Home.vue
Original file line number Diff line number Diff line change
Expand Up @@ -23,29 +23,30 @@

<h3>Database for open source vulnerabilities</h3>
<p>
OSV is a <router-link to="list">vulnerability database</router-link>
OSV.dev is a <router-link to="list">vulnerability database</router-link>
and triage infrastructure for open source projects aimed at helping
both open source maintainers and consumers of open source.
<p>
<p>
This feed contains vulnerabilities from
This infrastructure serves as an aggregator of vulnerabilities from
<a href="https://github.com/google/oss-fuzz">OSS-Fuzz</a> (mostly C/C++),
<a href="https://github.com/pypa/advisory-db">Python</a>, and
<a href="https://github.com/golang/vulndb">Go</a>, and
<a href="https://github.com/RustSec/advisory-db">Rust</a>, and
<a href="https://github.com/cloudsecurityalliance/gsd-database">GSD</a>, and
npm (from GitHub Security Advisories).

More <a href="https://github.com/google/osv/issues/44">to come</a>.
parts of GitHub Security Advisories (Maven, npm).
</p>
<p>
These databases have all adopted the
<a href="https://ossf.github.io/osv-schema/">OpenSSF Open Source
Vulnerability format</a>, making common tooling and aggregation very
simple. More data sources from other popular ecosystems are in the works.
</p>
<h4>API</h4>
<p>
For open source consumers, OSV provides an <a
href="https://osv.dev/docs/#section/Getting-Started">API</a> that lets
users query whether or not their versions are impacted.

These vulnerabilities are encoded in the
<a href="https://ossf.github.io/osv-schema/">OpenSSF Open Source Vulnerability format</a>.
</p>
<pre>
curl -X POST -d \
Expand All @@ -69,7 +70,8 @@
</p>
<h3>Open source</h3>
<p>
This is an <a href="https://github.com/google/osv">open source project</a> from <b>Google</b>.
This is an <a href="https://github.com/google/osv">open source project</a>.
We welcome contributions!
</p>
<h3>More information</h3>
<p>
Expand Down