Skip to content

Add Photon OS importer pipeline #1586 - #2226

Closed
Shivaay26 wants to merge 2 commits into
aboutcode-org:mainfrom
Shivaay26:features/my-first-issue
Closed

Shivaay26 wants to merge 2 commits into
aboutcode-org:mainfrom
Shivaay26:features/my-first-issue

Conversation

@Shivaay26

Copy link
Copy Markdown

Fixes #1586

Summary

Add an importer pipeline for Photon OS security advisories using the
OSV-format feed republished at https://github.com/captn3m0/photon-os-advisories

Changes

  • Add PhotonOSImporterPipeline in vulnerabilities/pipelines/photon_os_importer.py
  • Register pipeline in vulnerabilities/importers/__init__.py
  • Add unit tests and test data in vulnerabilities/tests/

Notes

  • Uses PHSA ID as the only alias to avoid cross-version alias conflicts
    since the same CVE appears in separate advisories for each
    Photon OS version (3.0, 4.0, 5.0)
  • CVEs stored as references instead of aliases to preserve the data
  • Handles inconsistent ranges format (dict vs list) present in upstream data
  • Deduplicates affected package entries — same purl appears multiple
    times per advisory with and without version data

Add a new importer pipeline to collect security advisories from
Photon OS, using the OSV-format feed republished at
https://github.com/captn3m0/photon-os-advisories

Signed-off-by: praveen <praveenshahi26@gmail.com>
Signed-off-by: praveen <praveenshahi26@gmail.com>
@ziadhany

Copy link
Copy Markdown
Collaborator

@Shivaay26, we already have an OSV parser, so there's no need to implement one from scratch.

also , It looks like the data from this source is just auto-generated from other sources,
https://github.com/captn3m0/photon-os-advisories/blob/main/generate.py

I think we should handle Photon OS by following the implementation in this PR: https://github.com/aboutcode-org/vulnerablecode/pull/2198

I really appreciate the effort and thanks for giving this a try!.

@ziadhany ziadhany closed this Mar 20, 2026
@Shivaay26

Copy link
Copy Markdown
Author

Thanks a lot for the detailed comment.

And I didn't know that new pr already exists, so it was my fault.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Datasource Request: Photon OS Advisories

2 participants