Import container/helm vulnerabilities from ArtifactHub.io

[taraspos]

Is your feature request related to a problem? Please describe.
Currently, osv.dev doesn't have much information about container image vulnerabilities.

At the same time Artifacthub.io runs trivy to scan container images¹, would be great to be able to see vulnerability information collected by Artifacthub in osv.dev.

Describe the solution you'd like
Integrate Artifacthub as datasource for vulnerabilities using Security Report API²

Describe alternatives you've considered
Fetching vulnerability information directly form ArtifactHub API²

Additional context

• Integrate security reports with OSV.dev artifacthub/hub#4052

Footnotes

1. https://artifacthub.io/docs/topics/security_report/ ↩

2. https://artifacthub.io/docs/api/#/Packages/getPackageSecurityReport ↩ ↩²

[andrewpollock]

Thanks for the endorsement and for raising this with Artifacthub.io as well. We're largely dependent on them choosing to publish OSV records before we can move this forward...