Root.io Datasource

[chait-slim]

• Prepare your data - refer to the OSV Schema documentation for information on how to properly format the data so it can be accepted.

• Create a PR to reserve an ID prefix and define a new ecosystem (example). We review the records you start publishing for OSV Schema correctness and quality as part of reviewing and merging this PR.

• Prepare and publish your records via a Git repository (example). If this method isn’t ideal, we also support publishing records from REST API endpoints or through a GCS bucket(example).

• To support API querying, please create a PR to extend purl_helpers.py and create a new ecosystem in _ecosystems.py. You can refer to existing examples showing how to implement support for Semver and non-Semver ecosystems.
  N/A for Root. We are not creating a new ecosystem

• Create a PR to start importing the records you are publishing into our test instance of OSV.dev and validate everything is working as intended there.

• Create a PR to start importing the records you are publishing into our production environment

[another-rex]

Hello! There seems to be a communication error here. From what I understand from this comment you are creating a new Ecosystem and publishing vulnerabilities specifically for Root images?

#3937 (comment)

Can you clarify what the ROOT-OS and ROOT-APP records are going to be for? Thanks!

[chait-slim]

Hello! There seems to be a communication error here. From what I understand from this comment you are creating a new Ecosystem and publishing vulnerabilities specifically for Root images?

#3937 (comment)

Can you clarify what the ROOT-OS and ROOT-APP records are going to be for? Thanks!

We are creating a feed that users of osv will be able to ingest:

User calls osv-scanner with: osv-scanner scan image abc:latest --vexfeed="https://root.io/vex/feed/"

(from this comment above the one you've sent #3937 (comment)).
Images that will have Root packages that have had cves and were fixed by Root will be found by this feed. So the images are not Root images, but Root augments packages of different ecosystems, both OS (Debian, Ubuntu, etc.) and App (python, npm, etc.). The two ids signify these fixes.
I might be completely missing the point here, but I think this precisely meets the requirements (maybe the description In the ticket is misleading)

[another-rex]

The VEX feed actually does not require a OSV prefix. For the osv-schema and osv.dev changes, we just need your own published records vulnerability records for your native base images.

The VEX feed is separate and independent. This is still ongoing in development, but the end result should not need any connection to OSV directly, as long as the package name you are patching matches the package name in OSV (i.e. the canonical package name in each ecosystem).

[chait-slim]

We have two tracks here that might have been confused:

1. We publish and host our own images with our packages installed both of which we manage, and this is the same as the support you have for similar distros - and we want OSV to record the findings for those packages
2. We also install pactches for any image which our users can install while using other ecosystems (both OS and app) - and for these we will need the VEX field

1 is very important to us for tracking purposes in the main OSV DB both for the internal OSV usage and as OSV is one of the main standards for downstream consumption of findings, which we want to both support and encourage.

It would be great to get this first effort through as it's the most timely, and then we would be very happy to be an early adopter and contrbiuter to the VEX feature.

Thanks!

[another-rex]

Yes, happy to fast track 1.

So for that we need a prefix and a ecosystem. Are the ROOT-APP and ROOT-OS prefixes for these records? These records will need to be publishing records for the Root ecosystem, not an existing ecosystem. If so, this should be ready to go.

Also do you have some example records that we can see for us to double check? Currently https://api.root.io/external/osv/all.json seems to 404.

[chait-slim]

So for that we need a prefix and a ecosystem. Are the ROOT-APP and ROOT-OS prefixes for these records? These records will need to be publishing records for the Root ecosystem, not an existing ecosystem. If so, this should be ready to go.

Yes sir. I've updated the PR accordingly

Also do you have some example records that we can see for us to double check? Currently https://api.root.io/external/osv/all.json seems to 404.

I just published it today (I wanted to first verify that the way we are building this is fine with you)

[another-rex]

Hmm... it still 404's to me.

[chait-slim]

Hi! Sorry about that! had an issue with deployment. Its up and running now:
https://api.root.io/external/osv/all.json -> Get all IDs
https://api.root.io/external/osv/{id}.json -> Data for specific ID

[chait-slim]

@another-rex did you get a chance to look at the outputs of the APIs?