Support regular re-enumeration of affected versions for existing records
- Dominant language
- Go
- Stars
- 2.9k
- Forks
- 369
- Avg merge
- 1d 17h
- Merged PRs (30d)
- 149
Description
**Problem statement:**
Today, [`affected[].versions`](https://ossf.github.io/osv-schema/#affectedversions-field) enumeration only occurs during the import of an OSV record.
#1987 has identified that it is conceivable that additional vulnerable versions may be released (for example, if the vulnerability was fixed in a backward-incompatible manner in a new major version branch) _after_ the OSV record has been published (and imported by OSV.dev).
This means that it is possible for the OSV.dev API to return false negatives for new vulnerable versions released after the OSV record has been published and imported.
False negatives detract from OSV.dev's strategy to be a comprehensive, accurate and timely database of known vulnerabilities.
**Proposed solution:**
Periodically (interval TBD), reimport all of the records for a given source, causing the affected versions for each record to be re-enumerated, based on the facts available at that point in time.
How this reimport is triggered will vary between the different currently supported data sources:
GCS: Set `ignore_last_import_time` to `true` for the given source record in `SourceRepository` in Datastore
Git: Set `last_synced_hash` to null for the given source record in `SourceRepository` in Datastore
REST: Set `ignore_last_import_time` to `true` for the given source record in `SourceRepository` in Datastore
Contributor guide
Assessment
This issue has not been assessed yet.