Software distribution method or binary type: MinimOS APK packages installed on MinimOS container images. Packages are stored in the standard APK database format at /lib/apk/db/installed. The existing os/apk extractor already parses this file and captures ID=minimos from /etc/os-release into metadata.OSID. No new file parsing is required , the data is already captured but never used for ecosystem routing.
Popularity of distribution method: MinimOS is a security-focused, minimal APK-based Linux distribution built for distroless container workloads. It publishes its own advisory feed with advisories prefixed MINI-.
Key adoption indicators:
- Google Cloud Artifact Analysis natively supports MinimOS container scanning, reflecting its use in production GCP environments
- Anchore/Grype officially recognizes
ID=minimos and routes it to the MinimOS ecosystem on OSV.dev (confirmed from Grype distro source)
- OSV.dev coverage: 64,849 security advisories are tracked under the
MinimOS ecosystem: https://osv.dev/list?ecosystem=MinimOS
Every MinimOS container scan with osv-scalibr today produces zero OS-level vulnerability matches all packages silently fall through to the wrong Alpine ecosystem.
Any critical, emergent vulnerability associated with software from the distribution method:
The following critical advisories are tracked under the MinimOS ecosystem on OSV.dev, but OSV-SCALIBR currently cannot detect any of them because the existing os/apk extractor does not map MinimOS packages to the correct OSV.dev ecosystem:
- MINI-26wc-ph53-p7mq -
curl - Severity: High/Critical _ multiple CVEs
- MINI-4x56-859r-prjq -
openssl - Severity: Critical _ OpenSSL security update
- MINI-547w-mfp7-933m -
openssl - Severity: High
- MINI-3729-6w87-2929 -
busybox - Severity: High
- MINI-28hq-3frr-vvg6 -
curl - Severity: High
Verified via OSV.dev API: curl alone has 29 undetected MinimOS advisories, openssl has 5+, busybox has 3+. All runtime-critical packages present in every MinimOS base image are affected.
Root cause: In extractor/filesystem/os/ecosystem/ecosystem.go, the *apkmeta.Metadata switch explicitly handles:
ID=wolfi → EcosystemWolfiID=chainguard → EcosystemChainguardID=alpaquita → EcosystemAlpaquita
But ID=minimos has no case — MinimOS APK packages fall through to EcosystemAlpine, which is wrong. Zero MINI-* advisories are matched.
MinimOS is a rolling release with no VERSION_ID set (same as Wolfi and Chainguard), so the fix follows the Wolfi pattern exactly. The EcosystemMinimOS constant is already defined at inventory/osvecosystem/parsed.go (line 126) and semantic/parse.go (line 91) has case "MinimOS" — but neither is ever referenced in ecosystem.go.
Proposed fix: Add one if-branch in the *apkmeta.Metadata case, before the version := m.ToDistro() guard (no new dependencies, no new extractor required):
if m.OSID == "minimos" {
return osvecosystem.FromEcosystem(osvconstants.EcosystemMinimOS)
}After this fix, PURL output will correctly be:
pkg:apk/minimos/curl@8.5.0-r0 → matched against MINI-26wc-ph53-p7mqpkg:apk/minimos/openssl@3.3.0-r0 → matched against MINI-4x56-859r-prjq
Resources:
Software distribution method or binary type: MinimOS APK packages installed on MinimOS container images. Packages are stored in the standard APK database format at
/lib/apk/db/installed. The existingos/apkextractor already parses this file and capturesID=minimosfrom/etc/os-releaseintometadata.OSID. No new file parsing is required , the data is already captured but never used for ecosystem routing.Popularity of distribution method: MinimOS is a security-focused, minimal APK-based Linux distribution built for distroless container workloads. It publishes its own advisory feed with advisories prefixed
MINI-.Key adoption indicators:
ID=minimosand routes it to the MinimOS ecosystem on OSV.dev (confirmed from Grype distro source)MinimOSecosystem: https://osv.dev/list?ecosystem=MinimOSEvery MinimOS container scan with osv-scalibr today produces zero OS-level vulnerability matches all packages silently fall through to the wrong Alpine ecosystem.
Any critical, emergent vulnerability associated with software from the distribution method:
The following critical advisories are tracked under the
MinimOSecosystem on OSV.dev, but OSV-SCALIBR currently cannot detect any of them because the existingos/apkextractor does not map MinimOS packages to the correct OSV.dev ecosystem:curl- Severity: High/Critical _ multiple CVEsopenssl- Severity: Critical _ OpenSSL security updateopenssl- Severity: Highbusybox- Severity: Highcurl- Severity: HighVerified via OSV.dev API:
curlalone has 29 undetected MinimOS advisories,opensslhas 5+,busyboxhas 3+. All runtime-critical packages present in every MinimOS base image are affected.Root cause: In
extractor/filesystem/os/ecosystem/ecosystem.go, the*apkmeta.Metadataswitch explicitly handles:ID=wolfi→EcosystemWolfiID=chainguard→EcosystemChainguardID=alpaquita→EcosystemAlpaquitaBut
ID=minimoshas no case — MinimOS APK packages fall through toEcosystemAlpine, which is wrong. ZeroMINI-*advisories are matched.MinimOS is a rolling release with no
VERSION_IDset (same as Wolfi and Chainguard), so the fix follows the Wolfi pattern exactly. TheEcosystemMinimOSconstant is already defined atinventory/osvecosystem/parsed.go(line 126) andsemantic/parse.go(line 91) hascase "MinimOS"— but neither is ever referenced inecosystem.go.Proposed fix: Add one if-branch in the
*apkmeta.Metadatacase, before theversion := m.ToDistro()guard (no new dependencies, no new extractor required):After this fix, PURL output will correctly be:
pkg:apk/minimos/curl@8.5.0-r0→ matched againstMINI-26wc-ph53-p7mqpkg:apk/minimos/openssl@3.3.0-r0→ matched againstMINI-4x56-859r-prjqResources:
MINI-26wc-ph53-p7mqadvisory (curl, High/Critical): https://osv.dev/vulnerability/MINI-26wc-ph53-p7mqMINI-4x56-859r-prjqadvisory (openssl, Critical): https://osv.dev/vulnerability/MINI-4x56-859r-prjqEcosystemMinimOSconstant already defined (line 126, never used in ecosystem.go): https://github.com/google/osv-scalibr/blob/main/inventory/osvecosystem/parsed.gosemantic/parse.goalready hascase "MinimOS"(line 91): https://github.com/google/osv-scalibr/blob/main/semantic/parse.gopkg:apk/minimos/<package>