diff --git a/AGENTS.md b/AGENTS.md index b84c1cbfa7a..e9e1a8f5d3c 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -25,9 +25,9 @@ It is structured as a multi-language monorepo: ### OSV Schema Reference Vulnerabilities across the entire system conform to the **Open Source Vulnerability (OSV) schema**. When AI agents need to understand the exact format, fields, and semantics of vulnerability records, refer to the local `osv-schema` submodule: -- **Full Specification**: [`osv/osv-schema/docs/schema.md`](osv/osv-schema/docs/schema.md) -- **Protobuf Definition**: [`osv/osv-schema/proto/vulnerability.proto`](osv/osv-schema/proto/vulnerability.proto) -- **JSON Schema**: [`osv/osv-schema/validation/schema.json`](osv/osv-schema/validation/schema.json) +- **Full Specification**: [`osv/osv-schema/docs/schema.md`](https://github.com/ossf/osv-schema/blob/main/docs/schema.md) +- **Protobuf Definition**: [`osv/osv-schema/proto/vulnerability.proto`](https://github.com/ossf/osv-schema/blob/main/proto/vulnerability.proto) +- **JSON Schema**: [`osv/osv-schema/validation/schema.json`](https://github.com/ossf/osv-schema/blob/main/validation/schema.json) --- diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 5b0ece8db3f..db8b6940c81 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -30,7 +30,7 @@ This helps ensure that your contribution is aligned with the project's goals and avoids duplicate efforts. When creating a pull request, please use the provided -[pull request template](/.github/PULL_REQUEST_TEMPLATE/pull_request_template.md) and fill out the +[pull request template](.github/PULL_REQUEST_TEMPLATE/pull_request_template.md) and fill out the sections to ensure a smooth review process. ### AI-assisted contributions diff --git a/docs/faq.md b/docs/faq.md index 6affa545bbd..63abc125a0b 100644 --- a/docs/faq.md +++ b/docs/faq.md @@ -27,7 +27,7 @@ OSV consists of: 1. [The OSV Schema](https://ossf.github.io/osv-schema/): An easy-to-use data format that maps precisely to open source versioning schemes. 2. Reference infrastructure ([OSV.dev website](https://osv.dev/), - [API](../api/), and tooling) that aggregates, + [API](api/), and tooling) that aggregates, [enriches](#what-does-osvdev-do-to-the-records-it-imports) and indexes vulnerability data from databases that use the OSV schema. 3. [OSV-Scanner](https://github.com/google/osv-scanner), the officially @@ -45,7 +45,7 @@ See our blog posts for more details: The OSV schema and OSV.dev can be used by: -1. Open source consumers: By querying [OSV.dev's API](../api/) and using our tooling to find known vulnerabilities in their dependencies. +1. Open source consumers: By querying [OSV.dev's API](api/) and using our tooling to find known vulnerabilities in their dependencies. 2. Open source projects: By publishing vulnerabilities in the OSV format and having them imported by OSV.dev. 3. Vulnerability database producers: By making the database available in the OSV format. @@ -67,7 +67,7 @@ The benefits of the OSV schema have led to adoption by several vulnerability dat ### How do I use OSV as an open source user? -OSV.dev provides an [easy-to-use API](../api/) for querying against the aggregated database of vulnerabilities. +OSV.dev provides an [easy-to-use API](api/) for querying against the aggregated database of vulnerabilities. [Command line tooling](https://github.com/google/osv-scanner) is also available for vulnerability scanning of SBOMs, language manifests, and container images. @@ -158,7 +158,7 @@ If you work on a project (like a Linux distribution) and would like to contribut 1. Version enumeration (for non-SemVer ecosystems where [supporting version enumeration code](https://github.com/google/osv.dev/tree/master/osv/ecosystems) exists) 2. [Package URL](https://github.com/package-url/purl-spec) [computation](https://github.com/google/osv.dev/blob/a751ceb26522f093edf26c0ad167cfd0967716d9/osv/models.py#L361-L365) (if necessary) 3. [Git affected commit enumeration and commit to tag mapping](https://github.com/google/osv.dev/blob/a751ceb26522f093edf26c0ad167cfd0967716d9/osv/impact.py#L422) -4. Repeat [batch](https://github.com/google/osv.dev/blob/master/deployment/clouddeploy/gke-workers/base/alias-computation.yaml) [computation](https://github.com/google/osv.dev/tree/master/gcp/workers/alias) of [aliases](https://ossf.github.io/osv-schema/#aliases-field) (**Note**: any time the `aliases` field changes, the record's [`modified`](https://ossf.github.io/osv-schema/#id-modified-fields) field is updated) +4. Repeat [batch](https://github.com/google/osv.dev/blob/master/deployment/clouddeploy/gke-workers/base/extra/relations.yaml) [computation](https://github.com/google/osv.dev/tree/master/go/cmd/relations) of [aliases](https://ossf.github.io/osv-schema/#aliases-field) (**Note**: any time the `aliases` field changes, the record's [`modified`](https://ossf.github.io/osv-schema/#id-modified-fields) field is updated) Both version and commit enumeration populate the [`affected.versions[]`](https://ossf.github.io/osv-schema/#affectedversions-field) field, which assists with precise version matching. diff --git a/gcp/website/blog/content/posts/2024-in-review/index.md b/gcp/website/blog/content/posts/2024-in-review/index.md index 8172a45605b..1cab15a2e60 100644 --- a/gcp/website/blog/content/posts/2024-in-review/index.md +++ b/gcp/website/blog/content/posts/2024-in-review/index.md @@ -26,7 +26,7 @@ This has brought the total number of supported ecosystems to 30. The significant ### Impact of the NVD's analysis challenges on Git commit range coverage Last year, we [announced](https://osv.dev/blog/posts/introducing-broad-c-c++-support/) the expansion of coverage of C/C++ software with Git range coverage of CVEs -programmatically converted from the NVD. The [reduction of the NVD's analysis capabilities](https://www.scworld.com/news/update-delays-to-nist-vulnerability-database-alarms-researchers) has had a broad impact on vulnerability management, and it has also impacted the effectiveness and comprehensiveness of this CVE conversion. Even with this unexpected challenge, slightly over 50% of in-scope CVEs have been able to be converted to OSV records with the [current implementation](https://github.com/google/osv.dev/tree/master/vulnfeeds/cmd/nvd-cve-osv). +programmatically converted from the NVD. The [reduction of the NVD's analysis capabilities](https://www.scworld.com/news/update-delays-to-nist-vulnerability-database-alarms-researchers) has had a broad impact on vulnerability management, and it has also impacted the effectiveness and comprehensiveness of this CVE conversion. Even with this unexpected challenge, slightly over 50% of in-scope CVEs have been able to be converted to OSV records with the [current implementation](https://github.com/google/osv.dev/tree/master/vulnfeeds/cmd/converters/cve/nvd-cve-osv). On the expectation that this may persist into 2025, and in light of [related](https://github.com/cisagov/vulnrichment) [developments](https://www.cisa.gov/securebydesign/pledge) this year, we will be exploring additionally converting CVEs directly from the [CVE List](https://github.com/CVEProject/cvelist). diff --git a/gcp/website/blog/content/posts/introducing-broad-c-c++-support/index.md b/gcp/website/blog/content/posts/introducing-broad-c-c++-support/index.md index 71284896921..eca3242ffd6 100644 --- a/gcp/website/blog/content/posts/introducing-broad-c-c++-support/index.md +++ b/gcp/website/blog/content/posts/introducing-broad-c-c++-support/index.md @@ -35,11 +35,13 @@ Matching C/C++ dependencies to known vulnerabilities has been one of the final p Submoduled dependencies retain their Git histories. [OSV-Scanner](https://google.github.io/osv-scanner/) [v1.4.3](https://github.com/google/osv-scanner/releases/tag/v1.4.3) is able to determine the most recent Git commits for the submoduled dependencies and return any associated vulnerabilities. + For example, let’s consider the archived [yuzu](https://github.com/yuzu-emu-mirror/yuzu) project repository and see if we can find any vulnerabilities in the project dependencies. We’ll be working from commit `43be2bfe332d5537041262eb08037993239eaf5f` for this example. Follow these steps: 1. Clone the yuzu project to your local machine using `git clone --recursive https://github.com/yuzu-emu-mirror/yuzu`. + 2. Checkout the relevant commit using `git -C yuzu checkout 43be2bfe332d5537041262eb08037993239eaf5f` 3. Run `osv-scanner yuzu` diff --git a/vulnfeeds/cmd/converters/cve/cve5/README.md b/vulnfeeds/cmd/converters/cve/cve5/README.md index a5072e5a327..3bf2362b53e 100644 --- a/vulnfeeds/cmd/converters/cve/cve5/README.md +++ b/vulnfeeds/cmd/converters/cve/cve5/README.md @@ -4,7 +4,7 @@ In this directory you will find two tools to convert CVEs from the CVEListV5 rep These converters are a continuation of the work described in the [Introducing broad C/C++ vulnerability management support](https://osv.dev/blog/posts/introducing-broad-c-c++-support/) -See [bulk-converter/run_cvelist-converter.sh](https://github.com/google/osv.dev/blob/master/vulnfeeds/cmd/converters/cve/cve5/bulk-converter/run_cvelist-converter.sh) for how this is invoked in Production. +See [bulk-converter/run-cvelist-converter.sh](bulk-converter/run-cvelist-converter.sh) for how this is invoked in Production. ## Usage diff --git a/vulnfeeds/cmd/converters/cve/nvd-cve-osv/README.md b/vulnfeeds/cmd/converters/cve/nvd-cve-osv/README.md index d7fb23c0832..f46bdbff193 100644 --- a/vulnfeeds/cmd/converters/cve/nvd-cve-osv/README.md +++ b/vulnfeeds/cmd/converters/cve/nvd-cve-osv/README.md @@ -2,7 +2,7 @@ Further context at [Introducing broad C/C++ vulnerability management support](https://osv.dev/blog/posts/introducing-broad-c-c++-support/) -See [run_cve_to_osv_generation.sh](https://github.com/google/osv.dev/blob/master/vulnfeeds/cmd/nvd-cve-osv/run_cve_to_osv_generation.sh) for how this is invoked in Production. +See [run_cve_to_osv_generation.sh](run_cve_to_osv_generation.sh) for how this is invoked in Production. To see it in action on a single CVE: @@ -71,7 +71,9 @@ $ gcloud --project oss-vdb logging read --freshness=12h --format=json 'logName=" ### Retrieve latest per-year-per-record CSV report 1. Decide the year of NVD conversion data to review (2016 to the current year) + 1. Visit [https://storage.googleapis.com/cve-osv-conversion/index.html?prefix=parts/nvd/nvd-conversion-outcomes-$YEAR](https://storage.googleapis.com/cve-osv-conversion/index.html?prefix=parts/nvd/nvd-conversion-outcomes-$YEAR) (for production) or [https://storage.googleapis.com/osv-test-cve-osv-conversion/index.html?prefix=parts/nvd/nvd-conversion-outcomes-$YEAR](https://storage.googleapis.com/osv-test-cve-osv-conversion/index.html?prefix=parts/nvd/nvd-conversion-outcomes-$YEAR) (for staging) based on the desired environment (note that this removes the prefixes of the filenames, making them look a bit weird). + 1. Open the downloaded file. The CSV should open in a browser tab, but it’s not really a Google Sheet (yet) ### Convert to a Google Sheet