Repository navigation
feat(sources-test): Add Red Hat Lightwell data source (test import) - #6139
Merged
jess-lowe merged 3 commits intoOct 20, 2026
Merged
Conversation
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
Adds project-lightwell/lightwell-osv as a GIT source under the Red Hat Lightwell ecosystem (db_prefix RHLW-). Records are single-ecosystem (Red Hat Lightwell:Maven / :PyPI) with opaque RHLW-YYYY-<hash> IDs, per the agreement in google#6105. strict_validation left off for the initial test import so records import and surface via importfindings.
syncrou
force-pushed
the
feat/add-red-hat-lightwell-data-source
branch
from
October 7, 2026 19:48
bb666e0 to
4b878ed
Compare
syncrou
marked this pull request as ready for review
October 7, 2026 20:04
syncrou
added a commit
to syncrou/osv.dev
that referenced
this pull request
Oct 7, 2026
Registers the Red Hat Lightwell ecosystem (Red Hat Lightwell:Maven / :PyPI). go/osv/ecosystem: redHatLightwellFactory delegates version semantics to the base ecosystem named by the :suffix (Maven/PyPI); an unsupported suffix yields a nil ecosystem (reported as not found). go/purl: generator delegates to the base ecosystem's registered PURL generator; no reverse parser is registered since pkg:maven/pkg:pypi types belong to the upstream ecosystems. Bumps the osv-schema bindings to the version defining EcosystemRedHatLightwell (ossf/osv-schema#571). Tests cover Maven/PyPI delegation and unsupported/missing suffixes. Companion to the source_test.yaml import (google#6139) and tracking issue google#6105.
This was referenced Oct 8, 2026
Move the lightwell entry between 'julia' and 'mageia' to match the alphabetical ordering of the other entries in source_test.yaml.
|
@another-rex @tobyhawker can you please take a look at this PR? |
jess-lowe
changed the title
Contributor
|
/gbrun |
Contributor
|
/gcbrun |
michaelkedar
added a commit
that referenced
this pull request
Oct 20, 2026
…ic + PURL) (#6142) ## What Adds OSV ecosystem support for **Red Hat Lightwell** (`Red Hat Lightwell:Maven`, `Red Hat Lightwell:PyPI`) so API version queries resolve for the data source in #6139. Tracking issue: #6105. ## Changes - **`go/osv/ecosystem`** — `redHatLightwellFactory` delegates version semantics to the base ecosystem named by the `:` suffix (`Maven`→Maven, `PyPI`→PyPI). Red Hat Lightwell republishes upstream artifacts at backport versions (`.rhlw-NNNNN` / `+rhlw.N`) that sort within the base ecosystem's version space, so base comparison is correct. An unsupported suffix yields a nil ecosystem (reported as "not found"). - **`go/purl`** — registers a PURL *generator* that delegates to the base ecosystem's generator. No reverse parser is registered: `pkg:maven` / `pkg:pypi` types are already owned by the upstream Maven/PyPI parsers (the registry panics on collision), so Lightwell PURL→ecosystem resolution is intentionally left to explicit ecosystem queries. - Bumps the osv-schema bindings to the version defining `EcosystemRedHatLightwell` (ossf/osv-schema#571). - Tests cover Maven/PyPI delegation and unsupported/missing suffixes. ## Related - #6139 — the `source_test.yaml` import for the Red Hat Lightwell data source. - Records: https://github.com/project-lightwell/lightwell-osv/tree/main/advisories (single `Red Hat Lightwell:<eco>` affected entries, opaque `RHLW-YYYY-<hash>` IDs). Co-authored-by: Michael Kedar <michaelkedar@google.com>
|
@jess-lowe or @michaelkedar can we merge this PR as well please? If test import is successful we will open a new PR for the main source.yaml file update. Thx! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds project-lightwell/lightwell-osv as a new OSV data source under the Red Hat Lightwell ecosystem (
db_prefix: RHLW-), viasource_test.yaml(test import first).Tracking issue: #6105.
Records
Red Hat Lightwell:Maven/Red Hat Lightwell:PyPI; the plainMaven/PyPIdual entries were dropped per the maintainer guidance in New data source: Red Hat Lightwell #6105 (they misrepresent ecosystem semantics for.rhlwversions that don't exist upstream).RHLW-YYYY-<16 hex>(MurmurHash3-128), per Tighten guidelines on acceptable IDs ossf/osv-schema#547.Red Hat Lightwellecosystem was registered via Add RHLW prefix for Red Hat Lightwell ossf/osv-schema#571 (shipped in v1.9.1).Config notes
type: 0(GIT),directory_path: advisories,ignore_patternsrestricts processing toRHLW-files.accepted_ecosystems: ['Red Hat Lightwell'](base name; records carry the:Maven/:PyPIsuffix — matching the AlmaLinux pattern).strict_validation: Falsefor this initial test import, so records import and any issues surface viaimportfindingsrather than hard-rejecting.Follow-up PR
A separate PR adds the new-ecosystem PURL mappings (
go/purl) and version logic (go/osv/ecosystem) for full API version querying, per the new-source checklist #6142