Skip to content

Commit

Permalink
Merge remote-tracking branch 'origin/main' into live
Browse files Browse the repository at this point in the history
  • Loading branch information
@oliverchang
oliverchang committed Sep 13, 2024
2 parents 3dfb377 + 87116d6 commit 4e5310e
Show file tree
Hide file tree
Showing 21 changed files with 9,543 additions and 66 deletions.
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -35,3 +35,4 @@
new ecosystems (Mageia, Chainguard).
- 2024-09-03 Released version 1.6.5. Added SuSE ecosystems and ELA, UBUNTU ID
prefixes.
- 2024-09-12 Released version 1.6.6. Add RHBA, RHEA, SUSE-OU prefixes.
54 changes: 29 additions & 25 deletions CHARTER.md
View file
Original file line number Diff line number Diff line change
@@ -1,30 +1,31 @@

# Technical Charter (the “Charter”) for OSV Schema a Series of LF Projects, LLC

**Adopted:**__________
Adopted August 29, 2024

This Charter sets forth the responsibilities and procedures for technical contribution to, and oversight of, the OSV Schema open source project, which has been established as OSV Schema a Series of LF Projects, LLC (the “Project”). LF Projects, LLC (“LF Projects”) is a Delaware series limited liability company. All contributors (including committers, maintainers, and other technical positions) and other participants in the Project (collectively, “Collaborators”) must comply with the terms of this Charter.
This Charter sets forth the responsibilities and procedures for technical contribution to, and oversight of, the OSV Schema open source project, which has been established as OSV Schema a Series of LF Projects, LLC (the “Project”).LF Projects, LLC (“LF Projects”) is a Delaware series limited liability company. All contributors (including committers, maintainers, and other technical positions) and other participants in the Project (collectively, “Collaborators”) must comply with the terms of this Charter.

## 1. Mission and Scope of the Project

a. The mission of the Project is to develop a standard interchange format for describing vulnerabilities in open source packages
a. The mission of the Project is to develop a standard interchange format for describing vulnerabilities in open source packages.

b. The scope of the Project includes collaborative development under the Project License (as defined herein) supporting the mission, including documentation, testing, integration and the creation of other artifacts that aid the development, deployment, operation or adoption of the open source project.

## 2. Technical Steering Committee
a. The Technical Steering Committee (the “TSC”) will be responsible for all technical oversight of the open source Project.

b. The TSC voting members are initially the Project’s Committers. At the inception of the project, the Committers of the Project will be as set forth within the “CONTRIBUTING” file within the Project’s code repository. The TSC may choose an alternative approach for determining the voting members of the TSC, and any such alternative approach will be documented in the CONTRIBUTING file. Any meetings of the Technical Steering Committee are intended to be open to the public, and can be conducted electronically, via teleconference, or in person.
a. The Technical Steering Committee (the “TSC”) will be responsible for all technical oversight of the open source Project.

b. The TSC voting members are initially the Project’s Committers. At the inception of the project, the Committers of the Project will be as set forth within the“CONTRIBUTING” file within the Project’s code repository. The TSC may choose an alternative approach for determining the voting members of the TSC, and any such alternative approach will be documented in the CONTRIBUTING file. Any meetings of the Technical Steering Committee are intended to be open to the public, and can be conducted electronically, via teleconference, or in person.

c. TSC projects generally will involve Contributors and Committers. The TSC may adopt or modify roles so long as the roles are documented in the CONTRIBUTING file. Unless otherwise documented:

i. Contributors include anyone in the technical community that contributes code, documentation, or other technical artifacts to the Project;
i. Contributors include anyone in the technical community that contributes code, documentation, or other technical artifacts to the Project;

ii. Committers are Contributors who have earned the ability to modify (“commit”) source code, documentation or other technical artifacts in a project’s repository; and

iii. A Contributor may become a Committer by a majority approval of the existing Committers. A Committer may be removed by a majority approval of the other existing Committers.
d. Participation in the Project through becoming a Contributor and Committer is open to anyone so long as they abide by the terms of this Charter.

d. Participation in the Project through becoming a Contributor and Committer is open to anyone so long as they abide by the terms of this Charter.

e. The TSC may (1) establish work flow procedures for the submission, approval, and closure/archiving of projects, (2) set requirements for the promotion of Contributors to Committer status, as applicable, and (3) amend, adjust, refine and/or eliminate the roles of Contributors, and Committers, and create new roles, and publicly document any TSC roles, as it sees fit.

Expand Down Expand Up @@ -60,10 +61,11 @@ c. Except as provided in Section 7.c. and 8.a, decisions by vote at a meeting re

d. In the event a vote cannot be resolved by the TSC, any voting member of the TSC may refer the matter to the Series Manager for assistance in reaching a resolution.

## 4. Compliance with Policies
a. This Charter is subject to the Series Agreement for the Project and the Operating Agreement of LF Projects. Contributors will comply with the policies of LF Projects as may be adopted and amended by LF Projects, including, without limitation the policies listed at https://lfprojects.org/policies/.
## 4. Compliance with Policies

a. This Charter is subject to the Series Agreement for the Project and the Operating Agreement of LF Projects. Contributors will comply with the policies of LF Projects as may be adopted and amended by LF Projects, including, without limitation the policies listed at [https://lfprojects.org/policies/](https://lfprojects.org/policies/).

b. The TSC may adopt a code of conduct (“CoC”) for the Project, which is subject to approval by the Series Manager. In the event that a Project-specific CoC has not been approved, the LF Projects Code of Conduct listed at [https://lfprojects.org/policies](https://lfprojects.org/policies) will apply for all Collaborators in the Project.
b. The TSC may adopt a code of conduct (“CoC”) for the Project, which is subject to approval by the Series Manager. In the event that a Project-specific CoC has not been approved, the LF Projects Code of Conduct listed at [https://lfprojects.org/policies/](https://lfprojects.org/policies/) will apply for all Collaborators in the Project.

c. When amending or adopting any policy applicable to the Project, LF Projects will publish such policy, as to be amended or adopted, on its web site at least 30 days prior to such policy taking effect; provided, however, that in the case of any amendment of the Trademark Policy or Terms of Use of LF Projects, any such amendment is effective upon publication on LF Project’s web site.

Expand All @@ -73,38 +75,40 @@ e. The Project will operate in a transparent, open, collaborative, and ethical m

## 5. Community Assets

a. LF Projects will hold title to all trade or service marks used by the Project (“Project Trademarks”), whether based on common law or registered rights. Project Trademarks will be transferred and assigned to LF Projects to hold on behalf of the Project. Any use of any Project Trademarks by Collaborators in the Project will be in accordance with the license from LF Projects and inure to the benefit of LF Projects.
a. LF Projects will hold title to all trade or service marks used by the Project (“Project Trademarks”), whether based on common law or registered rights. Project Trademarks will be transferred and assigned to LF Projects to hold on behalf of the Project. Any use of any Project Trademarks by Collaborators in the Project will be in accordance with the license from LF Projects and inure to the benefit of LF Projects.

b. The Project will, as permitted and in accordance with such license from LF Projects, develop and own all Project GitHub and social media accounts, and domain name registrations created by the Project community.

c. Under no circumstances will LF Projects be expected or required to undertake any action on behalf of the Project that is inconsistent with the tax-exempt status or purpose, as applicable, of the Joint Development Foundation or LF Projects, LLC.

## 6. General Rules and Operations.
## 6. General Rules and Operations.

a. The Project will:

i. engage in the work of the Project in a professional manner consistent with maintaining a cohesive community, while also maintaining the goodwill and esteem of LF Projects, Joint Development Foundation and other partner organizations in the open source community; and
ii. respect the rights of all trademark owners, including any branding and trademark usage guidelines.

ii. respect the rights of all trademark owners, including any branding and trademark usage guidelines.

## 7. Intellectual Property Policy

a. Collaborators acknowledge that the copyright in all new contributions will be retained by the copyright holder as independent works of authorship and that no contributor or copyright holder will be required to assign copyrights to the Project.
a. Collaborators acknowledge that the copyright in all new contributions will be retained by the copyright holder as independent works of authorship and that no contributor or copyright holder will be required to assign copyrights to the Project.

b. Except as described in Section 7.c., all contributions to the Project are subject to the following:

i. All new inbound code contributions to the Project must be made using Apache License, Version 2.0 available at [http://www.apache.org/licenses/LICENSE-2.0](http://www.apache.org/licenses/LICENSE-2.0) (the “Project License”).

b. Except as described in Section 7.c., all contributions to the Project are subject to the following:

i. All new inbound code contributions to the Project must be made using Apache License, Version 2.0 available at http://www.apache.org/licenses/LICENSE-2.0 (the “Project License”).

ii. All new inbound code contributions must also be accompanied by a Developer Certificate of Origin ([http://developercertificate.org](http://developercertificate.org)) sign-off in the source code system that is submitted through a TSC-approved contribution process which will bind the authorized contributor and, if not self-employed, their employer to the applicable license;

iii. All outbound code will be made available under the Project License.

iv. Documentation will be received and made available by the Project under the Creative Commons Attribution 4.0 International License (available at [http://creativecommons.org/licenses/by/4.0/](http://creativecommons.org/licenses/by/4.0/)). To the extent a contribution includes or consists of data, any rights in such data shall be made available under the CDLA-Permissive 2.0 License, available at https://cdla.dev/permissive-2-0.
iv. Documentation will be received and made available by the Project under the Creative Commons Attribution 4.0 International License (available at [http://creativecommons.org/licenses/by/4.0/(](http://creativecommons.org/licenses/by/4.0/)).

v. The Project may seek to integrate and contribute back to other open source projects (“Upstream Projects”). In such cases, the Project will conform to all license requirements of the Upstream Projects, including dependencies, leveraged by the Project. Upstream Project code contributions not stored within the Project’s main code repository will comply with the contribution process and license terms for the applicable Upstream Project.
v. The Project may seek to integrate and contribute back to other open source projects (“Upstream Projects”). In such cases, the Project will conform to all license requirements of the Upstream Projects, including dependencies, leveraged by the Project. Upstream Project code contributions not stored within the Project’s main code repository will comply with the contribution process and license terms for the applicable Upstream Project.

c. The TSC may approve the use of an alternative license or licenses for inbound or outbound contributions on an exception basis. To request an exception, please describe the contribution, the alternative open source license(s), and the justification for using an alternative open source license for the Project. License exceptions must be approved by a two-thirds vote of the entire TSC.

d. Contributed files should contain license information, such as SPDX short form identifiers, indicating the open source license or licenses pertaining to the file.

## 8. Amendments

a. This charter may be amended by a two-thirds vote of the entire TSC and is subject to approval by LF Projects.
55 changes: 22 additions & 33 deletions docs/schema.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ aside:
show_edit_on_github: true
---

**Version 1.6.5 (Sep 3, 2024)**
**Version 1.6.6 (Sep 12, 2024)**

Original authors:
- Oliver Chang ([email protected])
Expand Down Expand Up @@ -189,6 +189,17 @@ The defined database prefixes and their "home" databases are:
</ul>
</td>
</tr>
<tr>
<td><code>CGA</code></td>
<td><a href="https://packages.cgr.dev/chainguard/osv/all.json">Chainguard Security Notices</a></td>
<td>
<ul>
<li>How to contribute: TBD</li>
<li>Source URL: TBD</li>
<li>OSV Formatted URL: <code>https://packages.cgr.dev/chainguard/osv/&lt;ID&gt;.json</code></li>
</ul>
</td>
</tr>
<tr>
<td><code>CURL</code></td>
<td><a href="https://curl.se/docs/security.html">Curl CVEs</a></td>
Expand Down Expand Up @@ -355,7 +366,7 @@ The defined database prefixes and their "home" databases are:
</td>
</tr>
<tr>
<td><code>Red Hat</code></td>
<td><code>RHSA</code>/<code>RHBA</code>/<code>RHEA</code></td>
<td><a href="https://security.access.redhat.com/data">Red Hat Security Data</a></td>
<td>
<ul>
Expand Down Expand Up @@ -399,18 +410,7 @@ The defined database prefixes and their "home" databases are:
</td>
</tr>
<tr>
<td><code>UBUNTU</code></td>
<td><a href="https://ubuntu.com/security/cves">Ubuntu CVE Reports</a></td>
<td>
<ul>
<li>How to contribute: TBD</li>
<li>Source URL: <code>https://ubuntu.com/security/&lt;ID&gt;</code></li>
<li>OSV Formatted URL: <code>https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/&lt;YEAR&gt;/UBUNTU-&lt;ID&gt;.json</code></li>
</ul>
</td>
</tr>
<tr>
<td><code>SUSE-SU</code> and <code>openSUSE-SU</code></td>
<td><code>SUSE-SU</code>, <code>SUSE-RU</code>, <code>SUSE-FU</code>, <code>SUSE-OU</code> and <code>openSUSE-SU</code></td>
<td><a href="https://www.suse.com/support/security/">SUSE Security Landing page</a></td>
<td>
<ul>
Expand All @@ -421,35 +421,24 @@ The defined database prefixes and their "home" databases are:
</td>
</tr>
<tr>
<td><code>USN</code></td>
<td><a href="https://ubuntu.com/security/notices">Ubuntu Security Notices</a></td>
<td>
<ul>
<li>How to contribute: TBD</li>
<li>Source URL: <code>https://ubuntu.com/security/notices/&lt;ID&gt;</code></li>
<li>OSV Formatted URL: <code>https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/&lt;ID&gt;.json</code></li>
</ul>
</td>
</tr>
<tr>
<td><code>CGA</code></td>
<td><a href="https://packages.cgr.dev/chainguard/osv/all.json">Chainguard Security Notices</a></td>
<td><code>UBUNTU</code></td>
<td><a href="https://ubuntu.com/security/cves">Ubuntu CVE Reports</a></td>
<td>
<ul>
<li>How to contribute: TBD</li>
<li>Source URL: TBD</li>
<li>OSV Formatted URL: <code>https://packages.cgr.dev/chainguard/osv/&lt;ID&gt;.json</code></li>
<li>Source URL: <code>https://ubuntu.com/security/&lt;ID&gt;</code></li>
<li>OSV Formatted URL: <code>https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/&lt;YEAR&gt;/UBUNTU-&lt;ID&gt;.json</code></li>
</ul>
</td>
</tr>
<tr>
<td><code>CGA</code></td>
<td><a href="https://packages.cgr.dev/chainguard/osv/all.json">Chainguard Security Notices</a></td>
<td><code>USN</code></td>
<td><a href="https://ubuntu.com/security/notices">Ubuntu Security Notices</a></td>
<td>
<ul>
<li>How to contribute: TBD</li>
<li>Source URL: TBD</li>
<li>OSV Formatted URL: <code>https://packages.cgr.dev/chainguard/osv/&lt;ID&gt;.json</code></li>
<li>Source URL: <code>https://ubuntu.com/security/notices/&lt;ID&gt;</code></li>
<li>OSV Formatted URL: <code>https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/&lt;ID&gt;.json</code></li>
</ul>
</td>
</tr>
Expand Down
6 changes: 4 additions & 2 deletions tools/osv-linter/go.mod
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,21 +3,23 @@ module github.com/ossf/osv-schema/linter
go 1.22.6

require (
github.com/aquasecurity/go-pep440-version v0.0.0-20210121094942-22b2f8951d46
github.com/google/go-cmp v0.6.0
github.com/package-url/packageurl-go v0.1.3
github.com/sethvargo/go-retry v0.2.4
github.com/tidwall/gjson v1.17.1
github.com/urfave/cli/v2 v2.27.2
golang.org/x/mod v0.20.0
golang.org/x/term v0.23.0
)

require (
github.com/aquasecurity/go-pep440-version v0.0.0-20210121094942-22b2f8951d46 // indirect
github.com/aquasecurity/go-version v0.0.0-20210121072130-637058cfe492 // indirect
github.com/cpuguy83/go-md2man/v2 v2.0.4 // indirect
github.com/russross/blackfriday/v2 v2.1.0 // indirect
github.com/tidwall/match v1.1.1 // indirect
github.com/tidwall/pretty v1.2.0 // indirect
github.com/xrash/smetrics v0.0.0-20240312152122-5f08fbb34913 // indirect
golang.org/x/mod v0.20.0 // indirect
golang.org/x/sys v0.23.0 // indirect
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
)
Loading

0 comments on commit 4e5310e

Please sign in to comment.