feat(rootio): migrate source to per-advisory OSV v1.6.0 format by chait-slim · Pull Request #657 · aquasecurity/trivy-db

chait-slim · 2026-04-15T14:27:19Z

Migrates the Root.io vulnerability source from the legacy monolithic
cve_feed.json to per-advisory OSV v1.6.0 files under rootio/**/*.json,
using the shared pkg/vulnsrc/osv parser.

Each advisory's bucket is resolved by a single "Root:" bucket resolver
driven by the OSV ecosystem string (e.g. Root:Alpine:3.18) plus
database_specific.distro / distro_version. Only OS ecosystems are
supported.

Trivy resolution is unchanged: VulnSrcGetter.Get pulls every base-OS
advisory (Debian/Ubuntu/Alpine), then overlays Root.io's patched
versions on top, with Root.io winning only on vulnerability-ID
collision. Unfixed CVEs continue to surface from the upstream source.

DmitriyLewen · 2026-04-17T09:50:07Z

i think you can use osv packages.

You can see seal as example

chait-slim · 2026-04-23T14:44:03Z

@DmitriyLewen can you please review again the two PRs?

DmitriyLewen · 2026-05-04T13:44:41Z

+		ecosystem.Npm:      source,
+		ecosystem.Pip:      source,
+		ecosystem.RubyGems: source,


We migrate to OSV in this PR.

We don't need to add language ecosystems here.

DmitriyLewen · 2026-05-04T13:44:49Z

+	o := osv.New(vulnsDir, source.ID, dataSources,
+		osv.WithBucketResolver("alpine", resolveAlpineBucket),
+		osv.WithBucketResolver("debian", resolveDebianBucket),
+		osv.WithBucketResolver("ubuntu", resolveUbuntuBucket),


IIUC we can create a single function to resolve the Bucket based on the ecosystem.

It also makes sense to move this function into bucket.go.

DmitriyLewen · 2026-05-04T13:46:09Z

+	var dbSpec struct {
+		Distro        string `json:"distro"`
+		DistroVersion string `json:"distro_version"`
+	}


I would move this structure outside of the function — it's more readable that way.

DmitriyLewen · 2026-05-04T13:47:10Z


-func (vs VulnSrc) put(tx *bolt.Tx, platform string, feed Feed) error {
-	eb := oops.With("platform", platform).With("package", feed.PkgName).With("cve", feed.VulnerabilityID)
+		if dbSpec.Distro != "" {


Since we currently only support OS ecosystems — I think we should return an error if Distro is empty.

DmitriyLewen · 2026-05-04T13:50:19Z

-	return nil
+type config struct {
+	dbc    db.Operation
+	logger *log.Logger


unused now.

DmitriyLewen · 2026-05-04T13:51:00Z

can we use bucket now?

DmitriyLewen · 2026-05-04T13:52:58Z

can you update test files with severity?

…stems Addresses PR aquasecurity#657 review (DmitriyLewen, 2026-05-04) and aligns the parser with the actual root.io OSV feed (https://api.root.io/external/osv/all.zip). The feed emits ecosystem strings of the form "Root:<os>:<version>" (e.g. "Root:Alpine:3.18", "Root:Debian:11", "Root:Ubuntu:20.04"). The OSV parser splits on the first ":" and looks up the resolver under "root", passing "<os>:<version>" as the suffix — the previous Alpine/ Debian/Ubuntu resolvers would never have matched. - Replace the three per-OS resolvers with a single resolveBucket(suffix) in bucket.go that parses suffix into <os>+<version> and builds the Root.io bucket directly. - Reject suffixes without a version (Root:npm, Root:PyPI, Root:Maven, Root:Go) so the OSV parser skips language-ecosystem entries; this source is OS-only. - Drop the dataSources map (not needed without language ecosystems) and the database_specific JSON parse + per-entry bucket rewrite (the ecosystem string already carries the version). - Flatten VulnSrcGetter: drop the unused config/logger wrapper. - In Get(), derive the platform key from newOSBucket(...).Name() instead of the hand-rolled platformFormat constant. - Test fixtures use the real feed shape; add CVSSv3 severity coverage. Signed-off-by: Chai Tadmor <chai.tadmor@root.io>

Or if you want to be more explicit about what changed: refactor(rootio): replace cve_feed.json parser with OSV v1.6.0 walker I'd lean toward the first — it's a new capability (supporting the new vuln-list layout) rather than purely internal refactoring. The body could be: feat(rootio): migrate source to per-advisory OSV v1.6.0 format Replaces the monolithic cve_feed.json reader with a recursive fs.WalkDir over rootio/**/*.json. Each file is an OSV v1.6.0 advisory. OS advisories are keyed by "root.io {distro} {version}"; app advisories (npm, PyPI, etc.) are keyed by ecosystem name. Entries with empty affected[] or no fixed version are silently skipped. Signed-off-by: Chai Tadmor <chai.tadmor@root.io>

review feedback). A custom Transformer reads distro/distro_version from entry.DatabaseSpecific to build root.io OS buckets and drops advisories without a fixed version Signed-off-by: Chai Tadmor <chai.tadmor@root.io>

…stems Addresses PR aquasecurity#657 review (DmitriyLewen, 2026-05-04) and aligns the parser with the actual root.io OSV feed (https://api.root.io/external/osv/all.zip). The feed emits ecosystem strings of the form "Root:<os>:<version>" (e.g. "Root:Alpine:3.18", "Root:Debian:11", "Root:Ubuntu:20.04"). The OSV parser splits on the first ":" and looks up the resolver under "root", passing "<os>:<version>" as the suffix — the previous Alpine/ Debian/Ubuntu resolvers would never have matched. - Replace the three per-OS resolvers with a single resolveBucket(suffix) in bucket.go that parses suffix into <os>+<version> and builds the Root.io bucket directly. - Reject suffixes without a version (Root:npm, Root:PyPI, Root:Maven, Root:Go) so the OSV parser skips language-ecosystem entries; this source is OS-only. - Drop the dataSources map (not needed without language ecosystems) and the database_specific JSON parse + per-entry bucket rewrite (the ecosystem string already carries the version). - Flatten VulnSrcGetter: drop the unused config/logger wrapper. - In Get(), derive the platform key from newOSBucket(...).Name() instead of the hand-rolled platformFormat constant. - Test fixtures use the real feed shape; add CVSSv3 severity coverage. Signed-off-by: Chai Tadmor <chai.tadmor@root.io>

chait-slim · 2026-05-06T07:03:03Z

@DmitriyLewen addressed all comments

DmitriyLewen

Can you update PR description?

Also i left one question.

DmitriyLewen · 2026-05-06T14:13:01Z

-		{
-			name: "happy path with unsupported OS",
-			dir:  filepath.Join("testdata", "unsupported-os"),
+			// Skipped entries (empty affected, no fixed) must not create buckets


Could you elaborate on why you are skipping these CVEs (both with an empty affected and without a fixed version)?
Is this an internal root.io decision?
I assume that an empty affected means it is not yet known whether the package is vulnerable (correct me if I'm wrong), but I think we should still show vulnerabilities that don't have a fix yet, even if it's a potential vulnerability — users should be aware.

You're right that filtering these is questionable. The Root.io feed only publishes advisories where Root.io has shipped a patch: a "no fix" or "empty affected" entry shouldn't occur in real feed data, so the filter was just defensive code against malformed entries.
Removed it (and the test fixtures that only existed to exercise it).

a patch, so a no-fix or empty-affected entry shouldn't occur in real feed data. Filtering them silently was just defensive code; removing it lets malformed entries surface instead of being swallowed. Unfixed CVEs continue to reach users via the upstream OS source: VulnSrcGetter.Get merges base-OS advisories first, then overlays Root.io's patches on top. Signed-off-by: Chai Tadmor <chai.tadmor@root.io>

Replace types.SourceID with ecosystem.Type for the baseOS parameter: removes the awkward ecosystem.Type(strings.ToLower(string(...))) cast in Get() and aligns with seal.NewVulnSrcGetter, which already takes ecosystem.Type.

DmitriyLewen · 2026-05-07T09:53:19Z

Hi @chait-slim
I updated the PR a bit:

restored the comments
replaced sourceID with ecosystem (this will simplify the code and be consistent with other packages). For these changes I have already prepared a PR for Trivy —github.com/refactor(rootio): use ecosystem.Type instead of types.SourceID trivy#10629

Could you take a quick look?
Also, please review and fix the comments in aquasecurity/vuln-list-update#438.

Thanks in advance!

chait-slim requested a review from DmitriyLewen as a code owner April 15, 2026 14:27

chait-slim mentioned this pull request Apr 15, 2026

bug(rootio): cve_feed.json exceeds GitHub's 100 MB file size limit aquasecurity/vuln-list-update#427

Open

DmitriyLewen reviewed Apr 17, 2026

View reviewed changes

chait-slim force-pushed the rootio-osv branch from 626b511 to 70e73ab Compare April 26, 2026 12:44

DmitriyLewen reviewed May 4, 2026

View reviewed changes

chait-slim added 3 commits May 6, 2026 10:02

Replace the custom OSV walker/parser with pkg/vulnsrc/osv (per

4a87532

review feedback). A custom Transformer reads distro/distro_version from entry.DatabaseSpecific to build root.io OS buckets and drops advisories without a fixed version Signed-off-by: Chai Tadmor <chai.tadmor@root.io>

chait-slim force-pushed the rootio-osv branch from 7080515 to f87e304 Compare May 6, 2026 07:02

DmitriyLewen reviewed May 6, 2026

View reviewed changes

chait-slim and others added 3 commits May 6, 2026 17:57

style: revert comments for Get function

a0aa86d

DmitriyLewen mentioned this pull request May 7, 2026

refactor(rootio): use ecosystem.Type instead of types.SourceID aquasecurity/trivy#10629

Draft

8 tasks

Conversation

chait-slim commented Apr 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

chait-slim commented Apr 23, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

chait-slim commented May 6, 2026

Uh oh!

DmitriyLewen left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

DmitriyLewen commented May 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

chait-slim commented Apr 15, 2026 •

edited

Loading