Skip to content

Add upstream field.#312

Merged
oliverchang merged 4 commits intomainfrom
add-upstream
Dec 10, 2024
Merged

Add upstream field.#312
oliverchang merged 4 commits intomainfrom
add-upstream

Conversation

@oliverchang
Copy link
Copy Markdown
Collaborator

@oliverchang oliverchang commented Nov 15, 2024

Fixes #249.

@oliverchang
Add upstream field.
0a56215 
Fixes #249.

Signed-off-by: Oliver Chang <ochang@google.com>
This was referenced Nov 15, 2024
Closed
Open
@jasinner
Copy link
Copy Markdown
Collaborator

jasinner commented Nov 19, 2024

LGTM

luhring
luhring reviewed Nov 19, 2024
View reviewed changes
Copy link
Copy Markdown
Contributor

@luhring luhring left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looking good! Thanks for moving this forward. 🙇

Had a few thoughts on capturing the intent from our discussion in #249, but I defer to the OSV maintainers here.

docs/schema.md Outdated
publishes an advisory, the distribution's OSV record must not list the CVE ID as
an alias. Similarly, distributions often bundle multiple upstream
vulnerabilities into a single record. `related` should be used in these cases.
vulnerabilities into a single record. `upstream` should be used in these cases.
Copy link
Copy Markdown
Contributor

@luhring luhring Nov 18, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: I think it's slightly unclear what "these cases" refers to here, since this paragraph touches on both upstream and downstream packages.

Copy link
Copy Markdown
Collaborator Author

@oliverchang oliverchang Nov 20, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the pointing this out. I've tweaked the wording here to make it clearer.

oliverchang and others added 3 commits November 20, 2024 14:14
@oliverchang @luhring
Update docs/schema.md
f159452 
Co-authored-by: Dan Luhring <luhring@users.noreply.github.com>
Signed-off-by: Oliver Chang <oliverchang@users.noreply.github.com>
@oliverchang @luhring
Update docs/schema.md
591e0dc 
Co-authored-by: Dan Luhring <luhring@users.noreply.github.com>
Signed-off-by: Oliver Chang <oliverchang@users.noreply.github.com>
@oliverchang
Update schema.md
d588ce1 
Signed-off-by: Oliver Chang <oliverchang@users.noreply.github.com>
@oliverchang
Copy link
Copy Markdown
Collaborator Author

oliverchang commented Nov 20, 2024

Thanks for the suggestions @luhring !

@oliverchang oliverchang requested a review from darakian December 9, 2024 19:08
@darakian
Copy link
Copy Markdown
Contributor

darakian commented Dec 9, 2024

Without reading too deeply into this change it does seem like an interesting restriction to have available. Is anyone committing to producing OSV records which use this relation?

@oliverchang
Copy link
Copy Markdown
Collaborator Author

oliverchang commented Dec 10, 2024

Without reading too deeply into this change it does seem like an interesting restriction to have available. Is anyone committing to producing OSV records which use this relation?

We have a lot of positive feedback on #249 from various distro feed owners. The change itself is also proposed by @luhring from Chainguard. While "committing" is a strong word, I think this would be a field that will be used from these feeds.

@darakian
Copy link
Copy Markdown
Contributor

darakian commented Dec 10, 2024

Gotcha. Well then seems like a reasonable reference type to me 👍

@oliverchang oliverchang merged commit 57fd3dd into main Dec 10, 2024
@oliverchang oliverchang deleted the add-upstream branch December 10, 2024 21:31
@luhring
Copy link
Copy Markdown
Contributor

luhring commented Dec 10, 2024

Ditto what @oliverchang said — and we plan on using it for the Chainguard feed.

@oliverchang oliverchang mentioned this pull request Jan 14, 2025
Closed
andrewpollock added a commit to andrewpollock/osv-schema that referenced this pull request Feb 3, 2025
@andrewpollock
fix(jsonschema): add upstream field to schema definition
828456c 
This commit adds the `upstream` field to the schema definition. It was
omitted from ossf#312

Signed-off-by: Andrew Pollock <apollock@google.com>
@andrewpollock andrewpollock mentioned this pull request Feb 3, 2025
Merged
oliverchang pushed a commit that referenced this pull request Feb 3, 2025
@andrewpollock
fix(jsonschema): add upstream field to schema definition (#332)
a5a512f 
This commit adds the `upstream` field to the schema definition. It was
omitted from #312

Signed-off-by: Andrew Pollock <apollock@google.com>
@jess-lowe jess-lowe mentioned this pull request Feb 21, 2025
Merged
jess-lowe added a commit to google/osv.dev that referenced this pull request Feb 27, 2025
@jess-lowe
feat: add support for an 'upstream' field in the models (#3172)
1fe42bf 
This PR aims to prepare the models.py file to support the 'upstream'
field to be introduced by ossf/osv-schema#312.
Part of addressing #3052

This will calculate all of the transitive upstream dependencies of a
given CVE. Hierarchy will be calculated and determined by the frontend
in a later PR.
hogo6002 pushed a commit to hogo6002/osv.dev that referenced this pull request Feb 27, 2025
@jess-lowe @hogo6002
feat: add support for an 'upstream' field in the models (google#3172)
38c5c17 
This PR aims to prepare the models.py file to support the 'upstream'
field to be introduced by ossf/osv-schema#312.
Part of addressing google#3052

This will calculate all of the transitive upstream dependencies of a
given CVE. Hierarchy will be calculated and determined by the frontend
in a later PR.
@jess-lowe jess-lowe mentioned this pull request Mar 6, 2025
Closed
@jess-lowe jess-lowe mentioned this pull request Mar 18, 2025
Merged
andrewpollock pushed a commit that referenced this pull request Mar 18, 2025
@jess-lowe
tools: Update redhat csaf2osv conversion to support upstream field + …
e4c58d9 
…tests (#345)

CVE upstream has moved from `related` to `upstream` to support
#312 schema change.

The `GO` vuln alias (for the CVE entry) has been left in related, so as
not to affect the computation on the OSV.dev hierarchy display side.

Tests updated to the latest schema version as well.

Signed-off-by: Jess Lowe <jesslowe@google.com>
@jess-lowe jess-lowe mentioned this pull request Mar 18, 2025
Merged
@jess-lowe jess-lowe mentioned this pull request Mar 18, 2025
Merged
progval added a commit to progval/osv that referenced this pull request Dec 19, 2025
@progval
Update from 1.6.7 to 1.7.4
557927d 
Includes:

* 1.6.6: ossf/osv-schema#276
* 1.6.7: nothing
* 1.7.0: ossf/osv-schema#312 ossf/osv-schema#319 ossf/osv-schema#337
* 1.7.1: nothing
* 1.7.2: ossf/osv-schema#351 ossf/osv-schema#347 ossf/osv-schema#358
* 1.7.3: ossf/osv-schema#394
* 1.7.4: ossf/osv-schema#434 ossf/osv-schema#357
progval added a commit to progval/osv that referenced this pull request Dec 19, 2025
@progval
Update from 1.6.7 to 1.7.4
5262ca9 
Includes:

* 1.6.6: ossf/osv-schema#276
* 1.6.7: nothing
* 1.7.0: ossf/osv-schema#312 ossf/osv-schema#319 ossf/osv-schema#337
* 1.7.1: nothing
* 1.7.2: ossf/osv-schema#351 ossf/osv-schema#347 ossf/osv-schema#358
* 1.7.3: ossf/osv-schema#394
* 1.7.4: ossf/osv-schema#434 ossf/osv-schema#357
@progval progval mentioned this pull request Dec 19, 2025
Open
progval added a commit to progval/osv that referenced this pull request Dec 19, 2025
@progval
Update from 1.6.7 to 1.7.4
339f084 
Includes:

* 1.7.0: ossf/osv-schema#312 (`upstream` field) ossf/osv-schema#319 ossf/osv-schema#337 (`Ubuntu` as `severity` score)
* 1.7.1: nothing
* 1.7.2: ossf/osv-schema#351 ossf/osv-schema#347 ossf/osv-schema#358
* 1.7.3: ossf/osv-schema#394
* 1.7.4: ossf/osv-schema#434 ossf/osv-schema#357
progval added a commit to progval/osv that referenced this pull request Dec 19, 2025
@progval
Update from 1.6.7 to 1.7.4
40b567b 
Includes:

* 1.7.0:
  * ossf/osv-schema#312 (`upstream` field)
  * ossf/osv-schema#319
  * ossf/osv-schema#337 (`Ubuntu` as `severity` score)
* 1.7.1: nothing
* 1.7.2:
  * ossf/osv-schema#351
  * ossf/osv-schema#347
  * ossf/osv-schema#358
* 1.7.3:
  * ossf/osv-schema#394
* 1.7.4: ossf/osv-schema#434
  * ossf/osv-schema#357
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chrisbloom7 chrisbloom7 Awaiting requested review from chrisbloom7

@andrewpollock andrewpollock Awaiting requested review from andrewpollock

2 more reviewers

@luhring luhring luhring left review comments

@darakian darakian darakian approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Ensure that distro advisories and aliasing work well together

4 participants

@oliverchang @jasinner @darakian @luhring