Software distribution method or binary type: Mageia - RPM packages managed via urpmi/dnf/rpm. Packages reside in the standard RPM database at /var/lib/rpm/ on Mageia systems and container images (e.g. docker.io/mageia/mageia).

Popularity of distribution method: Mageia is an independent, community-driven
RPM-based Linux distribution forked from Mandriva Linux in 2010. It has a dedicated global community and is consistently ranked among the top RPM distributions by DistroWatch. Key facts:

• Docker Hub: The official mageia/mageia image has hundreds of thousands
  of pulls, used widely for containerised RPM-environment testing and CI pipelines.
• RPM ecosystem leader: Mageia is one of the longest-running independent
  RPM distributions, predating many modern alternatives; its security team
  publishes advisories under the MGASA prefix.
• Active security programme: Mageia has a dedicated security team
  (https://advisories.mageia.org/) that publishes timely advisories for
  every CVE affecting packages in its repositories.
• OSV.dev coverage: 5,941+ security advisories are tracked under the
  Mageia ecosystem on OSV.dev — all prefixed MGASA-.
  https://osv.dev/list?ecosystem=Mageia

Any critical, emergent vulnerability associated with software from the distribution method:

The following critical advisories are tracked under the Mageia ecosystem on
OSV.dev, but OSV-SCALIBR currently cannot detect any of them because the
existing os/rpm extractor does not map Mageia packages to the correct
OSV.dev ecosystem:

• MGASA-2022-0450 - openssl - CVE-2022-3602, CVE-2022-3786
  (stack buffer overflows in X.509 certificate verification, Critical)
  https://osv.dev/vulnerability/MGASA-2022-0450

• MGASA-2023-0298 - curl - CVE-2023-38545
  (SOCKS5 heap buffer overflow, CVSS 9.8, Critical)
  https://osv.dev/vulnerability/MGASA-2023-0298

• MGASA-2021-0526 - log4j - CVE-2021-44228
  (Log4Shell Remote Code Execution, CVSS 10.0, Critical)
  https://osv.dev/vulnerability/MGASA-2021-0526

• MGASA-2022-0049 - polkit - CVE-2021-4034
  (Pkexec local privilege escalation, CVSS 7.8, Important)
  https://osv.dev/vulnerability/MGASA-2022-0049

• MGASA-2023-0109 - sudo - CVE-2023-22809
  (sudoedit privilege escalation, CVSS 7.8, Important)
  https://osv.dev/vulnerability/MGASA-2023-0109

Root cause: In extractor/filesystem/os/ecosystem/ecosystem.go, the
*rpmmeta.Metadata switch correctly handles:

• ID=rhel → EcosystemRedHat
• ID=rocky → EcosystemRockyLinux
• ID=openEuler → EcosystemOpenEuler
• ID=almalinux → EcosystemAlmaLinux (added in extractor/os/rpm: add AlmaLinux ecosystem mapping #2148)

But ID=mageia has no case - any RPM package extracted from a Mageia
system falls through with an empty namespace, resulting in zero OSV matches
against the 5,941+ MGASA advisories on OSV.dev.

The EcosystemMageia constant is already defined in the codebase at
inventory/osvecosystem/parsed.go (line ~124) but is never referenced in
ecosystem.go.

Proposed fix: Add one if-branch in the *rpmmeta.Metadata case (no new
dependencies, no new extractor plugin required):

if m.OSID == "mageia" {
    return osvecosystem.Parsed{Ecosystem: osvconstants.EcosystemMageia, Suffix: m.OSVersionID}
}

After this fix, PURL output will correctly be:

• pkg:rpm/mageia/openssl@3.0.8-1.mga9 → matched against MGASA-2022-0450 (Critical)
• pkg:rpm/mageia/curl@7.88.1-1.mga9 → matched against MGASA-2023-0298 (CVSS 9.8)

Resources:

• OSV.dev Mageia ecosystem (5,941+ advisories):
  https://osv.dev/list?ecosystem=Mageia
• Mageia official security advisories:
  https://advisories.mageia.org/
• Mageia /etc/os-release reference (ID=mageia, VERSION_ID=9):
  https://wiki.mageia.org/en/Mageia_9_Release_Notes
• Docker Hub official Mageia image:
  https://hub.docker.com/r/mageia/mageia
• EcosystemMageia constant (already defined, just not used in ecosystem.go):
  https://github.com/google/osv-scalibr/blob/main/inventory/osvecosystem/parsed.go
• Existing AlmaLinux ecosystem mapping (same fix pattern, merged in extractor/os/rpm: add AlmaLinux ecosystem mapping #2148):
  https://github.com/google/osv-scalibr/blob/main/extractor/filesystem/os/ecosystem/ecosystem.go
• MGASA-2021-0526 (Log4Shell CVSS 10.0, undetected on Mageia scans):
  https://osv.dev/vulnerability/MGASA-2021-0526
• MGASA-2023-0298 (curl SOCKS5 heap overflow, CVSS 9.8):
  https://osv.dev/vulnerability/MGASA-2023-0298
• OSV-SCALIBR supported inventory types (gap confirmation — no Mageia entry):
  https://github.com/google/osv-scalibr/blob/main/docs/supported_inventory_types.md