Re: [I] feat(tools/osv): query OSV.dev for vulnerability cross-references during security triage [magpie]

["Kaap10 (via GitHub)" <gi...@apache.org>]

Kaap10 commented on issue #311:
URL: https://github.com/apache/magpie/issues/311#issuecomment-5751263833

   Hi @potiuk,
   
   Just opened PR #1297 
   
   I've implemented `tools/osv/` (`contract:security-cross-ref`) as a lightweight, read-only bridge to OSV.dev. The main focus was unlocking the **CVE ↔ GHSA alias graph** and multi-ecosystem lookups so triage skills (`security-issue-triage`, `security-issue-deduplicate`, `security-cve-allocate`) can quickly catch duplicate reports and verify downstream impact before allocating a new CVE.
   
   ### Key highlights in the PR:
   - **Clean POSIX `curl` + `jq` recipes** covering ID lookups, package/version scans, public commit checks, and batch queries.
   - **Strict embargo boundaries** per `PRINCIPLES.md §15` to ensure private commits, reproducer branches, or draft CVE copy are never leaked to external endpoints.
   - **Full taxonomy & neutrality sync** across `docs/labels-and-capabilities.md`, `docs/vendor-neutrality.md`, and the validator/scoring tools.
   - All CI checks (`prek`, `rat`, `CodeQL`, pytest suites) are passing green.
   
   Whenever you have some time, I’d love to get your thoughts and feedback on it!


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org