Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Register HSEC database and Hackage ecosystem in osv-schema #4

Closed
frasertweedale opened this issue May 16, 2023 · 8 comments · Fixed by ossf/osv-schema#157
Closed

Register HSEC database and Hackage ecosystem in osv-schema #4

frasertweedale opened this issue May 16, 2023 · 8 comments · Fixed by ossf/osv-schema#157
Assignees
@mihaimaruseac

Comments

@frasertweedale
Copy link
Collaborator

osv-schema has a registry of advisory database identifiers (https://ossf.github.io/osv-schema/#id-modified-fields) and a registry of "package ecosystems" (https://ossf.github.io/osv-schema/#affectedpackage-field). We should send a PR to register the HSEC advisory database, and Hackage (as well as, perhaps, GHC itself, e.g. see the definition for Linux).
@TristanCacqueray
Copy link
Collaborator

Once the system is in place, we should also create an issue for https://github.com/github/advisory-database#sources .

@mihaimaruseac mihaimaruseac self-assigned this May 17, 2023
@frasertweedale
Copy link
Collaborator Author

I propose registering:

  • HSEC database id
  • Hackage ecosystem name
  • GHC ecosystem name, for components of GHC itself (compiler, GHCi, RTS, etc)

@mihaimaruseac
Copy link
Collaborator

Working on this right now, will have a PR by end of week

@mihaimaruseac mihaimaruseac mentioned this issue Jun 11, 2023
Merged
@frasertweedale
Copy link
Collaborator Author

PR was merged: ossf/osv-schema#157

But the updates have not been "released". And we still need to give some examples. So I guess we leave this open for now.

@frasertweedale
Copy link
Collaborator Author

frasertweedale commented Jul 21, 2023 •
edited

Everything is done on the osv.dev side (google/osv.dev#1463). Probably we just need to add some examples to the osv-schema repo, and then we can close this.

@mihaimaruseac
Copy link
Collaborator

Yeah, I have left some TODOs there, I'll take care of them during this weekend.

mihaimaruseac added a commit to mihaimaruseac/osv-schema that referenced this issue Aug 23, 2023
@mihaimaruseac
Fill in TODOs in Haskell parts of osv-schema
85c5e46 
I had left 2 TODOs to add JSON examples. Filling them now (will redo the GHC
one when we get a real GHC issue) and closing
haskell/security-advisories#4.

Signed-off-by: Mihai Maruseac <mihai.maruseac@gmail.com>
@mihaimaruseac mihaimaruseac mentioned this issue Aug 23, 2023
Merged
@mihaimaruseac mihaimaruseac reopened this Aug 23, 2023
@mihaimaruseac
Copy link
Collaborator

Closed accidentally due to the way I set-up the upstream/fork repos

oliverchang pushed a commit to ossf/osv-schema that referenced this issue Sep 12, 2023
@mihaimaruseac
Fill in TODOs in Haskell parts of osv-schema (#198)
8974fa5 
I had left 2 TODOs to add JSON examples. Filling them now (will redo the
GHC one when we get a real GHC issue) and closing
haskell/security-advisories#4.

---------

Signed-off-by: Mihai Maruseac <mihai.maruseac@gmail.com>
@frasertweedale
Copy link
Collaborator Author

The osv-schema PR was merged. This ticket is resolved.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@mihaimaruseac mihaimaruseac

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Add Haskell ecosystem vulnerability and advisory types mihaimaruseac/osv-schema
3 participants
@TristanCacqueray @mihaimaruseac @frasertweedale