Repository navigation
Use osv-linter instead of check-jsonschema to validate advisories - #47
Merged
Merged
Conversation
The OSV linter checks schema conformance (SCH:001) as well as additional data quality rules such as overlapping range events, missing affected data and invalid purls. Use the offline collection, as there is no opam package registry checker. Fixes ocaml#15
Collaborator
Author
|
Will add opam registry checker to osv linter |
Member
|
looks fine to me, thanks! |
Member
should this PR wait for that, or what is the concrete plan (enhancing osv linter? adding things here?)? |
Collaborator
Author
I already have a PR for it, but might take a while to get merge. Will create a separate PR for it. We will also need to change some of the CVEs due to inaccurate version number, i.e. OCaml 4 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #15.
Replaces the
check-jsonschemastep in bothvalidate-pull.ymlandgenerate-osv.ymlwith the OSV linter from ossf/osv-schema(
tools/osv-linter), installed viago install ...@latest.The linter's SCH:001 check covers the existing JSON schema validation, and
it additionally catches issues the schema alone accepts, e.g.:
affected--collection offlineis used since the linter has no opam registrychecker (PKG:001/PKG:002 are no-ops for opam), and this keeps the job free
of network lookups driven by record contents.
All 35 records currently on
generated-osvpass the linter.