Support repo/dump of the data about osv.dev HOT 6 CLOSED

that sounds great, is there any timeline on it?

@elanzini This is a priority for us and we are hoping to have this in the coming weeks and months.

thanks for the clarification, we have been discussing something similar for VulnerableCode and may be we could evolve some common data structures. Food for thoughts

@pombredanne We would love to see the minimal schema we have today (https://osv.dev/docs/#tag/vulnerability_schema) be extended and more adopted. It would be super awesome if the open source world could agree on a commonly adopted format for describing vulnerabilities in a minimal way for the purpose of aggregation and interchange/notification.

We are very open to suggestions for (backwards compatible) changes if you have any.

from osv.dev.

Hi yes!

This is planned as part of #44. These dumped vulnerability data can also be edited by the community to improve the accuracy of the data.

(I'll close this as a duplicate).

from osv.dev.

@oliverchang I am not sure what in #44 is about providing a data dump of all vulnerabilities in your DB?

from osv.dev.

@pombredanne The model that we are envisioning for integrating new sources is for there to be YAML files which serve as the source of truth, so by default the data is available in a repo.

For the existing case (OSS-Fuzz bugs), the data will be dumped in the same format into a repo as well.

from osv.dev.

@oliverchang that sounds great, is there any timeline on it?

from osv.dev.

@pombredanne The model that we are envisioning for integrating new sources is for there to be YAML files which serve as the source of truth, so by default the data is available in a repo.

For the existing case (OSS-Fuzz bugs), the data will be dumped in the same format into a repo as well.

@oliverchang thanks for the clarification, we have been discussing something similar for VulnerableCode and may be we could evolve some common data structures. Food for thoughts

@sbs2001 ping FYI ^

from osv.dev.