google / google/osv-scanner

Add RPM/Red Hat ecosystem support

Open
#254 2 comments 2 reactions 0 assignees View on GitHub
backlog good first issue
Dominant language
Go
Stars
11k
Forks
792
Avg merge
1d 20h
Merged PRs (30d)
48

Description

As briefly discussed [here](https://github.com/google/osv-scanner/pull/164#issuecomment-1405729223), `osv.dev` has not support for RPM Ecosystem (right now) but, if you think that it makes sense, we can start discussing it.

Managing rpmdb is different from other lockfiles already supported until now by `osv-scanner` because they are not text files but instead:

- BerkeleyDB files for rpm before v4.16
- SQLite file for rpm v4.16 and later

Support using current osv-scanner API is straightforward and also the `io.Reader` support scenario should have no problems (see my latest update of draft #164 that uses temporary files).
I made a PR, of course let me know if it makes sense to you of it's worth waiting support on `osv.dev` side.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.