feat(test): add BellSoft Security Advisory feed to test environment (…

[i-bs]

…#3263)

Ecosystems:

• Alpaquita Linux
• BellSoft Hardened Containers

ref: #3263

[another-rex]

It looks like the records that are in that repository has IDs starting with CVE, but all the records has to being with the prefix defined in the schema: BELL-SA

We would also prefer the filename to also start with BELL-SA, but that's technically optional, but the record ID itself definitely has to start with BELL-SA.

[i-bs]

thank you for your guidance.

It looks like the records that are in that repository has IDs starting with CVE, but all the records has to being with the prefix defined in the schema: BELL-SA

I see. Then e.g. for CVE-2025-48060 we'll have our packages visible at URL https://osv.dev/vulnerability/BELL-SA-2025-48060 , not https://osv.dev/vulnerability/CVE-2025-48060 (with Alpine and Debian packages) ?

If so what can be done for having our packages in https://osv.dev/vulnerability/CVE-2025-48060 ?

We would also prefer the filename to also start with BELL-SA, but that's technically optional, but the record ID itself definitely has to start with BELL-SA.

we can change it, yes.

Also you didn't notice the wrong ecosystem fields. We'll change it too.

[jess-lowe]

I see. Then e.g. for CVE-2025-48060 we'll have our packages visible at URL https://osv.dev/vulnerability/BELL-SA-2025-48060 , not https://osv.dev/vulnerability/CVE-2025-48060 (with Alpine and Debian packages) ?

That is correct. We're looking to actually move the Alpine and Debian packages away from this main CVE ID, and move them to their own records, so the CVE-ID version will only involve data ingested directly from NVD/CVEList. The logic behind this on our end is that there are too many trackers and ecosystems referencing the same vulns to meanfully display them in one record, and not all users will need information from multiple distros. This will also allow better clarity around where we get our data from.

Instead, please put the reference to the CVE-ID you are addressing in the 'upstream' field (this takes an array). On the frontend, all of the 'downstream' vulnerability references will be computed and shown like so on the 'upsteam' CVE ID entry:

side note: this section will be moved up higher for better visibility soon (PR is in review).

[i-bs]

@jess-lowe , thank you so much for the detailed explanation.

Then before I fix the things you're pointing at, I need this to be checked and merged: ossf/osv-schema#361

Thanks.

[jess-lowe]

Awesome, I will nudge the relevant reviewers for you :)