Package: osv
OSV - Open Source Vulnerabilitiesosv.devis avulnerability databaseand triage infrastructure for open
source projects aimed at helping both open source maintainers and consumers of
open source.This repository contains the infrastructure code that servesosv.dev(and other user tooling). This infrastructure serves as an aggregator
of vulnerability databases that have adopted theOpenSSF Vulnerability format.osv.devadditionally provides infrastructure to ensure affected versions are
accurately represented in each vulnerability entry, through bisection and
version analysis.Current data sourcesThis is an ongoing project.We encourage open source ecosystems to adopt theOpenSSF Vulnerability formatto enable
open source users to easily aggregate and consume vulnerabilities across all
ecosystems. See ourblog postfor more details.The following ecosystems have vulnerabilities encoded in this format:GitHub Advisory Database(CC-BY 4.0)PyPI Advisory Database(CC-BY 4.0)Go Vulnerability Database(CC-BY 4.0)Rust Advisory Database(CC0 1.0)Global Security Database(CC0 1.0)OSS-Fuzz(CC-BY 4.0)Additionally, the OSV.dev team maintains a conversion pipeline for:Debian Security Advisories,
using the conversion toolshere.Alpine SecDB,
using the conversion toolshere.Together, these include vulnerabilities from:Androidcrates.ioDebian GNU/LinuxGitHub ActionsGoHexLinux kernelMavennpmNuGetOSS-FuzzPackagistPubPyPIRubyGemsData dumpsFor convenience, these sources are aggregated and continuously exported to a GCS
bucket maintained by OSV:[gs://osv-vulnerabilities](https://osv-vulnerabilities.storage.googleapis.com).This bucket contains individual entries of the formatgs://osv-vulnerabilities/<ECOSYSTEM>/<ID>.jsonas well as a zip containing all
vulnerabilities for each ecosystem atgs://osv-vulnerabilities/<ECOSYSTEM>/all.zip.E.g. for PyPI vulnerabilities:# Or download over HTTP via https://osv-vulnerabilities.storage.googleapis.com/PyPI/all.zipgsutilcpgs://osv-vulnerabilities/PyPI/all.zip.A list of all current ecosystems is available atgs://osv-vulnerabilities.storage.googleapis.com/ecosystems.txtViewing the web UIAn instance of OSV's web UI is deployed athttps://osv.dev.Using the APIcurl-XPOST-d\'{"commit": "6879efc2c1596d11a6a6ad296f80063b558d5e0f"}'\"https://api.osv.dev/v1/query"curl-XPOST-d\'{"version": "2.4.1", "package": {"name": "jinja2", "ecosystem": "PyPI"}}'\"https://api.osv.dev/v1/query"Detailed documentation for using the API can be found athttps://osv.dev/docs/.Using the scannerWe provide a Go based tool that will scan your dependencies, and check them
against the OSV database for known vulnerabilities via the OSV API.Currently it is able to scan various lockfiles, debian docker containers, SPDX
and CycloneDB SBOMs, and git repositories.The scanner is located in it'sown repository here.ArchitectureYou can find an overview of OSV's architecturehere.This repositoryThis repository contains all the code for runninghttps://osv.devon GCP. This
consists of:API server (gcp/api)Web interface (gcp/appengine)Workers for bisection and impact analysis (docker/worker)You'll need to check out submodules as well for many local building steps to
work:gitsubmoduleupdate--init--recursiveDevelopmentSeeCONTRIBUTING.md.Third party tools and integrationsThere are also community tools that use OSV. Note that these are community built
tools and unsupported by the core OSV maintainers.Betterscan.io: Code Scanning/SAST/Static Analysis/Linting using many
tools/Scanners with One Report (Code,
IaC)bomberCortex XSOARDependency-Trackdep-scanEZE-CLI: The one stop shop for security testing in modern developmentGolang support for the schemaG-Rath/osv-detector: A scanner
that uses the OSV database.it-depends.NET client library and support for the schemaOSS Review ToolkitPackjpip-auditRenovateRust client librarySkjold: Security audit python project dependencies against several security
advisory databasesTrivyFeel free to send a PR to add your project here.ContributingContributions are welcome! We also have amailing listand aFAQ.