Skip to content

Commit 79fccfe

Browse files
keshav-spacekeshav-space
committed
feat: add schema for federated advisory data
resolves: aboutcode-org/federatedcode#67 Signed-off-by: Keshav Priyadarshi <git@keshav.space>
1 parent 49dfd98 commit 79fccfe

4 files changed

Lines changed: 222 additions & 1 deletion

File tree

‎docs/source/advisory-schema.rst‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
.. _advisory_schema:
2+
3+
VulnerableCode Advisory Schema
4+
==============================
5+
6+
Below is the JSON schema for advisories federated by the
7+
``federate_vulnerabilities_v2`` pipeline.
8+
9+
You can also download the schema `here <https://raw.githubusercontent.com/aboutcode-org/vulnerablecode/refs/heads/main/docs/source/schemas/vulnerablecode-advisory.schema-0.1.json>`_.
10+
11+
.. literalinclude:: schemas/vulnerablecode-advisory.schema-0.1.json
12+
:language: json

‎docs/source/index.rst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,7 @@ Reference documentation for VulnerableCode features and customizations.
9999
- :ref:`command_line_interface`
100100
- :ref:`importers_link`
101101
- :ref:`pipeline_avid_mapping`
102+
- :ref:`advisory_schema`
102103

103104
.. rst-class:: column column2 bottom-right
104105

‎docs/source/schemas/vulnerablecode-advisory.schema-0.1.json‎

Lines changed: 205 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,205 @@
1+
{
2+
"$schema": "http://json-schema.org/draft-07/schema#",
3+
"$id": "https://raw.githubusercontent.com/aboutcode-org/vulnerablecode/refs/heads/main/docs/source/schemas/vulnerablecode-advisory.schema-0.1.json",
4+
"title": "AdvisoryDataV2",
5+
"version": "0.1",
6+
"type": "object",
7+
"definitions": {
8+
"AffectedPackageV2": {
9+
"description": "Relate a Package-URL with a range of affected versions and fixed versions.",
10+
"properties": {
11+
"purl": {
12+
"title": "Base Package-URL",
13+
"type": "string",
14+
"description": "Package-URL (purl) identifying the base package. Ref: https://www.packageurl.org/docs/purl/specification"
15+
},
16+
"affected_versions": {
17+
"anyOf": [
18+
{
19+
"type": "string"
20+
},
21+
{
22+
"type": "null"
23+
}
24+
],
25+
"default": null,
26+
"title": "Affected VERS Version Range",
27+
"description": "VERS range describing affected package versions. Ref: https://www.packageurl.org/docs/vers/specification"
28+
},
29+
"fixed_versions": {
30+
"anyOf": [
31+
{
32+
"type": "string"
33+
},
34+
{
35+
"type": "null"
36+
}
37+
],
38+
"default": null,
39+
"title": "Fixed VERS Version Range",
40+
"description": "VERS range describing fixed package versions. Ref: https://www.packageurl.org/docs/vers/specification"
41+
},
42+
"introduced_in_commits": {
43+
"items": {
44+
"$ref": "#/definitions/PackageCommitPatchData"
45+
},
46+
"title": "Introduced By Commit Patches",
47+
"type": "array"
48+
},
49+
"fixed_in_commits": {
50+
"items": {
51+
"$ref": "#/definitions/PackageCommitPatchData"
52+
},
53+
"title": "Fixed By Commit Patches",
54+
"type": "array"
55+
}
56+
},
57+
"required": [
58+
"package"
59+
],
60+
"title": "AffectedPackageV2",
61+
"type": "object"
62+
},
63+
"PackageCommitPatchData": {
64+
"properties": {
65+
"vcs_url": {
66+
"title": "VCS URL",
67+
"type": "string"
68+
},
69+
"commit_hash": {
70+
"title": "Commit Hash",
71+
"type": "string"
72+
}
73+
},
74+
"required": [
75+
"vcs_url",
76+
"commit_hash"
77+
],
78+
"title": "PackageCommitPatchData",
79+
"type": "object"
80+
},
81+
"ReferenceV2": {
82+
"properties": {
83+
"reference_id": {
84+
"default": "",
85+
"title": "Reference ID",
86+
"type": "string"
87+
},
88+
"reference_type": {
89+
"default": "",
90+
"title": "Reference Type",
91+
"type": "string"
92+
},
93+
"url": {
94+
"default": "",
95+
"title": "Reference URL",
96+
"type": "string"
97+
}
98+
},
99+
"title": "ReferenceV2",
100+
"type": "object"
101+
},
102+
"VulnerabilitySeverity": {
103+
"properties": {
104+
"scoring_system": {
105+
"title": "System",
106+
"type": "string"
107+
},
108+
"score": {
109+
"title": "Value",
110+
"type": "string"
111+
},
112+
"scoring_elements": {
113+
"default": "",
114+
"title": "Scoring Elements",
115+
"type": "string"
116+
},
117+
"published_at": {
118+
"anyOf": [
119+
{
120+
"format": "date-time",
121+
"type": "string"
122+
},
123+
{
124+
"type": "null"
125+
}
126+
],
127+
"default": null,
128+
"title": "Published At"
129+
},
130+
"url": {
131+
"anyOf": [
132+
{
133+
"type": "string"
134+
},
135+
{
136+
"type": "null"
137+
}
138+
],
139+
"default": null,
140+
"title": "Url"
141+
}
142+
},
143+
"title": "VulnerabilitySeverity",
144+
"type": "object"
145+
}
146+
},
147+
"description": "Schema to describe a VulnerableCode Advisory.",
148+
"properties": {
149+
"advisory_id": {
150+
"default": "",
151+
"title": "Advisory ID",
152+
"type": "string"
153+
},
154+
"datasource_id": {
155+
"default": "",
156+
"title": "DataSource ID",
157+
"type": "string"
158+
},
159+
"datasource_url": {
160+
"default": "",
161+
"title": "DataSource URL",
162+
"type": "string"
163+
},
164+
"aliases": {
165+
"items": {
166+
"type": "string"
167+
},
168+
"title": "Aliases",
169+
"type": "array"
170+
},
171+
"summary": {
172+
"default": "",
173+
"title": "Summary",
174+
"type": "string"
175+
},
176+
"impacted_packages": {
177+
"items": {
178+
"$ref": "#/definitions/AffectedPackageV2"
179+
},
180+
"title": "Affected Packages",
181+
"type": "array"
182+
},
183+
"references": {
184+
"items": {
185+
"$ref": "#/definitions/ReferenceV2"
186+
},
187+
"title": "References",
188+
"type": "array"
189+
},
190+
"weaknesses": {
191+
"items": {
192+
"type": "string"
193+
},
194+
"title": "Weaknesses",
195+
"type": "array"
196+
},
197+
"severities": {
198+
"items": {
199+
"$ref": "#/definitions/VulnerabilitySeverity"
200+
},
201+
"title": "Severities",
202+
"type": "array"
203+
}
204+
}
205+
}

‎vulnerabilities/pipes/export.py‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,12 @@
1313
from vulnerabilities.models import ImpactedPackage
1414
from vulnerabilities.models import ImpactedPackageAffecting
1515
from vulnerabilities.models import ImpactedPackageFixedBy
16-
from vulnerabilities.models import PackageCommitPatch
1716
from vulnerabilities.models import PackageV2
1817

18+
# Warning!
19+
# Any changes to the structure of the advisory exporter also require updating the advisory
20+
# schema documentation at `docs/source/advisory-schema.rst`.
21+
1922

2023
def package_prefetched_qs(checkpoint):
2124
count = None

0 commit comments

Comments
 (0)