Records on osv.dev do not meet the published json-schema
- Dominant language
- Go
- Stars
- 2.9k
- Forks
- 369
- Avg merge
- 1d 17h
- Merged PRs (30d)
- 149
Description
**Describe the bug**
I have noticed quite a number of records, particularly the openSUSE records do not conform to the published json schema.
For openSUSE ecosystem on osv.dev I have found around 3,600 records fail the published json schema because the 'URL' field is missing. There are only ~10,0000 so this is impacting a large fraction of records for openSUSE.
**To Reproduce**
For example, here is an openSUSE OSV record that has a 'reference' with 'ADVISORY' present but no URL is provided, as required per the schema, following the schema validation methods here https://github.com/ossf/osv-schema/tree/main/validation
```shell
$ curl https://raw.githubusercontent.com/ossf/osv-schema/refs/heads/main/validation/schema.json -o schema.json
$ curl https://api.osv.dev/v1/vulns/openSUSE-SU-2024:14510-1 -o record.json
$ check-jsonschema --schemafile schema.json record.json
Schema validation errors were encountered.
record.json::$.references[0]: 'url' is a required property
```
**Expected behaviour**
I had hoped all the records published on osv.dev followed the published specification. Am I maybe missing something?
**Screenshots**
If applicable, add screenshots to help explain your problem.
**Additional context**
Add any other context about the problem here.
Contributor guide
Assessment
This issue has not been assessed yet.