feat: enhanced OSV transformer#3252
Closed
willmurphyscode wants to merge 9 commits into
Closed
Conversation
And add an r matcher Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>
orizerah
added a commit
to orizerah/vunnel
that referenced
this pull request
May 18, 2026
Set database_specific.anchore.record_type = "advisory" on every record so grype-db's OSV transformer (anchore/grype#3252) routes the affected ranges into UnaffectedPackageHandle rather than the affected store. Echo ships patched builds of upstream PyPI/npm packages; treating those ranges as "X is vulnerable" would false-positive every non-Echo consumer. Also merge OSV 1.7 `upstream` into `aliases` (deduped) so cross-source CVE/GHSA bridging works at scan time -- the transformer reads aliases but not upstream, and without that bridge grype can't link an ECHO-* unaffected record to a GHSA/NVD match on the same package. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
orizerah
added a commit
to orizerah/vunnel
that referenced
this pull request
May 18, 2026
Set database_specific.anchore.record_type = "advisory" on every record so grype-db's OSV transformer (anchore/grype#3252) routes the affected ranges into UnaffectedPackageHandle rather than the affected store. Echo ships patched builds of upstream PyPI/npm packages; treating those ranges as "X is vulnerable" would false-positive every non-Echo consumer. Also merge OSV 1.7 `upstream` into `aliases` (deduped) so cross-source CVE/GHSA bridging works at scan time -- the transformer reads aliases but not upstream, and without that bridge grype can't link an ECHO-* unaffected record to a GHSA/NVD match on the same package. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> Signed-off-by: Ori Zerah <ori.zerah@echohq.com>
Contributor
Author
|
Closed in favor of #3441 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
There have been a couple of vunnel PRs that are held up by the lack of generality in the OSV schema (which was originally written to handle Bitnami data specifically and then lightly patched to handle AlmaLinux data.)
Generalize the transformer so that the following PRs can be tested and merged:
The plan here is to get all of those PRs green and having quality gates (aside from the static analysis failing because they depend on a grype branch) and then merge this, and then merge them.