New data source: Homebrew
- Dominant language
- Go
- Stars
- 2.9k
- Forks
- 369
- Avg merge
- 1d 17h
- Merged PRs (30d)
- 149
Description
Homebrew publishes OSV-format advisory records at https://github.com/Homebrew/advisory-database under the `Homebrew` ecosystem with `BREW-` ids and `pkg:brew` purls. This issue tracks onboarding it as an osv.dev data source.
- [x] Prepare your data — records validate against the OSV schema (checked on every push in the source repo)
- [x] Create a PR to reserve an ID prefix and define a new ecosystem — ossf/osv-schema#576 (merged); URLs and version-ordering language in ossf/osv-schema#580
- [x] Prepare and publish your records via a Git repository — https://github.com/Homebrew/advisory-database (`advisories/*.json`)
- [ ] To support API querying, please create a PR to extend `purl_helpers.py` and create a new ecosystem in `_ecosystems.py` — see below
- [ ] Create a PR to start importing into `source_test.yaml`
- [ ] Create a PR to start importing into `source.yaml`
For the ecosystem/purl PR: `pkg:brew` maps to `Homebrew` with no namespace (`EcosystemPURL('brew', None)`). Version comparison is Homebrew's `PkgVersion`: an upstream version segment ordered by [Homebrew's `Version` class](https://github.com/Homebrew/brew/blob/HEAD/Library/Homebrew/version.rb), then a numeric `_N` revision suffix (e.g. `1.81.6_5 < 1.81.6_6 < 1.82.0`). There isn't a Homebrew comparator in `third_party/univers` or `osv-scalibr/semantic` today so this needs a small new implementation; the `_sort_key` shape is `(version_tokens, revision_int)`. Happy to also add the Go-side entries in `go/osv/ecosystem/` and `go/purl/` in the same PR if that's preferred over Python-only.
Proposed `source_test.yaml` entry:
```yaml
- name: homebrew
type: 0
repo_url: https://github.com/Homebrew/advisory-database
db_prefix: [BREW]
accepted_ecosystems: [Homebrew]
human_link: https://github.com/Homebrew/advisory-database/blob/main/advisories/
link: https://raw.githubusercontent.com/Homebrew/advisory-database/main/advisories/
directory_path: advisories
extension: '.json'
```
Background: https://github.com/orgs/Homebrew/discussions/6869. `pkg:brew` was registered in package-url/purl-spec#796.
Contributor guide
Research direction
Start with purl_helpers.py and _ecosystems.py, then review the existing ecosystem and version-comparison implementations referenced by the issue. Add Homebrew API support with the specified pkg:brew mapping and ordering, and inspect source_test.yaml and source.yaml for the import entries. Done means Homebrew advisories can be queried and imported; Go entries in go/osv/ecosystem/ and go/purl/ are optional.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, python
- Domain
- api, databases, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 68/100