google / google/osv.dev

Support Maven registries in OSV entries

Open
#2,088 2 comments 0 reactions 0 assignees View on GitHub
backlog enhancement
Dominant language
Go
Stars
2.9k
Forks
369
Avg merge
1d 17h
Merged PRs (30d)
149

Description

https://github.com/ossf/osv-schema/pull/231 was just merged, which adds optional Maven registries to the Maven ecosystem:

i.e.

```
"package": {
"ecosystem": "Maven:https://mycoolregistry.com",
"name": "io.netty:netty-handler"
},
```

There are some additional considerations to be made here for our matching logic:

The default assumed registry is `https://repo.maven.apache.org/maven2` (and perhaps other common variants/mirrors?). API queries must take this into account, with `{"ecosystem": "Maven"}` and `{"ecosystem": "Maven:https://repo.maven.apache.org/maven2"}` both matching against OSV entries with either formatting. We may want to just normalize Maven ecosystems on ingestion to strip the Maven central URL if it is provided.

Unlike with other Linux distros queries, where `{"ecosystem": "Debian"}` matches against OSV entries with `{"ecosystem": "Debian:"}`, API queries specifying `{"ecosystem": "Maven"}` should **not** match against all registries. It should default to Maven Central per above.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.