Echo Data Source

[orizerah]

Hi, I'm a part of the Echo team, we create secured, 0-CVE images.
We maintain our own minimal operating system, and a security advisory.
We also publish them in OSV format, and would like to add it as a data source to OSV.

Index: https://advisory.echohq.com/osv/all.json
Advisories: https://advisory.echohq.com/osv/ADVISORY-ID.json

[another-rex]

Thanks! Give us a few days to look into all the PRs.

I'm not too familiar with what package manager / index echo uses under the hood (if any), but you might also be interested in adding an extractor for Echo into https://github.com/google/osv-scalibr/, so both osv-scalibr and osv-scanner will support scanning those images with this data.

[orizerah]

@another-rex we use apt as a package manager, do we still need to add something?

[another-rex]

There's probably 2 parts to consider here:

For debian based distros, we look in /var/lib/dpkg/status file (or files under /var/lib/dpkg/status.d/), so as long as Echo still writes the file indexes under this directory, 90% of the extraction should be done. (For reference, this is the code for extraction)

The second part is setting the ecosystem correctly. By default we use the ID field in /etc/os-release, so if ID=echo, then everything should basically work out of the box, otherwise we just need to add some custom logic there to figure out that this is a echo image.

[orizerah]

We do write the file indexes there, the same as Debian.
And it is ID=echo in the /etc/os-release file.

[orizerah]

Hey @another-rex am I supposed to see Echo in the test environment? How long does it suppose to take until it's imported there?

[another-rex]

Yes, there's just a slight issue with ECHO prefix not quite added, but that's fixed in this ossf/osv-schema#412 and we just need to update the submodule in this repository.

Should be seeing Echo entries by end of day today.

[another-rex]

We found a new issue with your records, currently the "severity" field is invalid because you are using "ECHO". We only support this list as valid types: https://ossf.github.io/osv-schema/#severitytype-field

Is it possible to emit a CVSS score, this would be the easiest approach. Otherwise you can do something similar to Ubuntu, though you would need to have concrete definitions for each level, e.g. https://ubuntu.com/security/cves/about#priority

Generally we suggest using the CVSS framework if you want to add a severity.