You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
There are some additional considerations to be made here for our matching logic:
The default assumed registry is https://repo.maven.apache.org/maven2 (and perhaps other common variants/mirrors?). API queries must take this into account, with {"ecosystem": "Maven"} and {"ecosystem": "Maven:https://repo.maven.apache.org/maven2"} both matching against OSV entries with either formatting. We may want to just normalize Maven ecosystems on ingestion to strip the Maven central URL if it is provided.
Unlike with other Linux distros queries, where {"ecosystem": "Debian"} matches against OSV entries with {"ecosystem": "Debian:<anything>"}, API queries specifying {"ecosystem": "Maven"} should not match against all registries. It should default to Maven Central per above.
The text was updated successfully, but these errors were encountered:
oliverchang
added
backlog
Important but currently unprioritized
and removed
stale
The issue or PR is stale and pending automated closure
labels
Sep 29, 2024
ossf/osv-schema#231 was just merged, which adds optional Maven registries to the Maven ecosystem:
i.e.
There are some additional considerations to be made here for our matching logic:
The default assumed registry is
https://repo.maven.apache.org/maven2
(and perhaps other common variants/mirrors?). API queries must take this into account, with{"ecosystem": "Maven"}
and{"ecosystem": "Maven:https://repo.maven.apache.org/maven2"}
both matching against OSV entries with either formatting. We may want to just normalize Maven ecosystems on ingestion to strip the Maven central URL if it is provided.Unlike with other Linux distros queries, where
{"ecosystem": "Debian"}
matches against OSV entries with{"ecosystem": "Debian:<anything>"}
, API queries specifying{"ecosystem": "Maven"}
should not match against all registries. It should default to Maven Central per above.The text was updated successfully, but these errors were encountered: