google / google/osv.dev

Records on osv.dev do not meet the published json-schema

Open
#3,662 5 comments 0 reactions 0 assignees View on GitHub
data quality stale
Dominant language
Go
Stars
2.9k
Forks
369
Avg merge
1d 17h
Merged PRs (30d)
149

Description

**Describe the bug**
I have noticed quite a number of records, particularly the openSUSE records do not conform to the published json schema.

For openSUSE ecosystem on osv.dev I have found around 3,600 records fail the published json schema because the 'URL' field is missing. There are only ~10,0000 so this is impacting a large fraction of records for openSUSE.

**To Reproduce**

For example, here is an openSUSE OSV record that has a 'reference' with 'ADVISORY' present but no URL is provided, as required per the schema, following the schema validation methods here https://github.com/ossf/osv-schema/tree/main/validation

```shell
$ curl https://raw.githubusercontent.com/ossf/osv-schema/refs/heads/main/validation/schema.json -o schema.json
$ curl https://api.osv.dev/v1/vulns/openSUSE-SU-2024:14510-1 -o record.json
$ check-jsonschema --schemafile schema.json record.json

Schema validation errors were encountered.
record.json::$.references[0]: 'url' is a required property
```

**Expected behaviour**

I had hoped all the records published on osv.dev followed the published specification. Am I maybe missing something?

**Screenshots**
If applicable, add screenshots to help explain your problem.

**Additional context**
Add any other context about the problem here.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.