Skip to content

extractor/os/rpm: add Mageia ecosystem mapping#2199

Open
herdiyana256 wants to merge 1 commit into
google:mainfrom
herdiyana256:feature/os-mageia-ecosystem
Open

extractor/os/rpm: add Mageia ecosystem mapping#2199
herdiyana256 wants to merge 1 commit into
google:mainfrom
herdiyana256:feature/os-mageia-ecosystem

Conversation

@herdiyana256

Copy link
Copy Markdown
Contributor

Closes #2177

Problem

Currently, when OSV-SCALIBR extracts RPM packages from a Mageia distribution, the *rpmmeta.Metadata switch in extractor/filesystem/os/ecosystem/ecosystem.go does not recognize the mageia OSID. As a result, it falls through to the default behavior and returns an empty ecosystem namespace.

This prevents OSV-SCALIBR from matching any extracted packages against the 5,941+ official Mageia security advisories tracked on OSV.dev. None of these advisories are reachable today because the ecosystem is never correctly set.

Examples of critical but undetected advisories due to this missing mapping:

  • MGASA-2021-0526 - log4j — Log4Shell RCE (CVSS 10.0, Critical)
  • MGASA-2023-0298 - curl — SOCKS5 heap overflow (CVSS 9.8, Critical)
  • MGASA-2022-0450 - openssl — CVE-2022-3602/3786 (Critical)
  • MGASA-2022-0049 - polkit — CVE-2021-4034 (CVSS 7.8)
  • MGASA-2023-0109 - sudo — CVE-2023-22809 (CVSS 7.8)

Solution

This PR adds support for mapping Mageia RPM packages to the correct OSV.dev ecosystem:

  • Adds a check for m.OSID == "mageia" in ecosystem.go which explicitly returns osvconstants.EcosystemMageia.
  • Uses m.OSVersionID as the suffix to capture the major version correctly (e.g. Mageia:9), matching the taxonomy of OSV.dev advisories.
  • Adds comprehensive unit test cases (Mageia_9, Mageia_8, and Mageia_no_version) in ecosystem_test.go to validate parsing.
  • Updates the official plugin documentation (docs/supported_inventory_types.md) to reflect that the RPM extractor now supports Mageia.

Note: E2E tests for the Mageia ecosystem will follow as a separate PR in the osv-scanner repository (similar to the AlmaLinux follow-up pattern in google/osv-scanner#2870).

Before / After

Before:
pkg:rpm//openssl@3.0.8-1.mga9 ← namespace empty, zero MGASA matches

After:
pkg:rpm/mageia/openssl@3.0.8-1.mga9 (ecosystem: Mageia:9)

Verification

$ go test ./extractor/filesystem/os/ecosystem/... -v -run TestEcosystemRPM
=== RUN   TestEcosystemRPM
=== RUN   TestEcosystemRPM/Mageia_9
=== RUN   TestEcosystemRPM/Mageia_8
=== RUN   TestEcosystemRPM/Mageia_no_version
--- PASS: TestEcosystemRPM (0.00s)
    --- PASS: TestEcosystemRPM/Mageia_9 (0.00s)
    --- PASS: TestEcosystemRPM/Mageia_8 (0.00s)
    --- PASS: TestEcosystemRPM/Mageia_no_version (0.00s)
PASS
ok  	github.com/google/osv-scalibr/extractor/filesystem/os/ecosystem	0.007s

$ go test ./extractor/filesystem/os/ecosystem/...
PASS

$ go test ./extractor/filesystem/os/rpm/...
PASS

$ go vet ./extractor/filesystem/os/ecosystem/...

@herdiyana256

Copy link
Copy Markdown
Contributor Author

PR submitted: #2199

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

PRP: Fix os/rpm extractor to support Mageia ecosystem (ID=mageia not mapped, zero MGASA advisories detected)

1 participant