osv 0.1.0.0 → 0.2.0.0
raw patch · 4 files changed
+38/−13 lines, 4 filesdep +purldep ~basedep ~cvssdep ~tastynew-uploaderPVP ok
version bump matches the API change (PVP)
Dependencies added: purl
Dependency ranges changed: base, cvss, tasty, time
API changes (from Hackage documentation)
- Security.OSV: [$sel:affectedDatabaseSpecific:Affected] :: Affected dbSpecific ecosystemSpecific rangeDbSpecific -> Maybe dbSpecific
- Security.OSV: [$sel:affectedEcosystemSpecific:Affected] :: Affected dbSpecific ecosystemSpecific rangeDbSpecific -> Maybe ecosystemSpecific
- Security.OSV: [$sel:affectedPackage:Affected] :: Affected dbSpecific ecosystemSpecific rangeDbSpecific -> Package
- Security.OSV: [$sel:affectedRanges:Affected] :: Affected dbSpecific ecosystemSpecific rangeDbSpecific -> [Range rangeDbSpecific]
- Security.OSV: [$sel:affectedSeverity:Affected] :: Affected dbSpecific ecosystemSpecific rangeDbSpecific -> [Severity]
- Security.OSV: [$sel:creditContacts:Credit] :: Credit -> [Text]
- Security.OSV: [$sel:creditName:Credit] :: Credit -> Text
- Security.OSV: [$sel:creditType:Credit] :: Credit -> CreditType
- Security.OSV: [$sel:modelAffected:Model] :: Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific -> [Affected affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific]
- Security.OSV: [$sel:modelAliases:Model] :: Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific -> [Text]
- Security.OSV: [$sel:modelCredits:Model] :: Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific -> [Credit]
- Security.OSV: [$sel:modelDatabaseSpecific:Model] :: Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific -> Maybe dbSpecific
- Security.OSV: [$sel:modelDetails:Model] :: Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific -> Maybe Text
- Security.OSV: [$sel:modelId:Model] :: Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific -> Text
- Security.OSV: [$sel:modelModified:Model] :: Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific -> UTCTime
- Security.OSV: [$sel:modelPublished:Model] :: Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific -> Maybe UTCTime
- Security.OSV: [$sel:modelReferences:Model] :: Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific -> [Reference]
- Security.OSV: [$sel:modelRelated:Model] :: Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific -> [Text]
- Security.OSV: [$sel:modelSchemaVersion:Model] :: Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific -> Text
- Security.OSV: [$sel:modelSeverity:Model] :: Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific -> [Severity]
- Security.OSV: [$sel:modelSummary:Model] :: Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific -> Maybe Text
- Security.OSV: [$sel:modelWithdrawn:Model] :: Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific -> Maybe UTCTime
- Security.OSV: [$sel:packageEcosystem:Package] :: Package -> Text
- Security.OSV: [$sel:packageName:Package] :: Package -> Text
- Security.OSV: [$sel:packagePurl:Package] :: Package -> Maybe Text
- Security.OSV: [$sel:referencesType:Reference] :: Reference -> ReferenceType
- Security.OSV: [$sel:referencesUrl:Reference] :: Reference -> Text
- Security.OSV: instance GHC.Classes.Ord Security.OSV.Package
+ Security.OSV: [affectedDatabaseSpecific] :: Affected dbSpecific ecosystemSpecific rangeDbSpecific -> Maybe dbSpecific
+ Security.OSV: [affectedEcosystemSpecific] :: Affected dbSpecific ecosystemSpecific rangeDbSpecific -> Maybe ecosystemSpecific
+ Security.OSV: [affectedPackage] :: Affected dbSpecific ecosystemSpecific rangeDbSpecific -> Package
+ Security.OSV: [affectedRanges] :: Affected dbSpecific ecosystemSpecific rangeDbSpecific -> [Range rangeDbSpecific]
+ Security.OSV: [affectedSeverity] :: Affected dbSpecific ecosystemSpecific rangeDbSpecific -> [Severity]
+ Security.OSV: [creditContacts] :: Credit -> [Text]
+ Security.OSV: [creditName] :: Credit -> Text
+ Security.OSV: [creditType] :: Credit -> CreditType
+ Security.OSV: [modelAffected] :: Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific -> [Affected affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific]
+ Security.OSV: [modelAliases] :: Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific -> [Text]
+ Security.OSV: [modelCredits] :: Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific -> [Credit]
+ Security.OSV: [modelDatabaseSpecific] :: Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific -> Maybe dbSpecific
+ Security.OSV: [modelDetails] :: Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific -> Maybe Text
+ Security.OSV: [modelId] :: Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific -> Text
+ Security.OSV: [modelModified] :: Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific -> UTCTime
+ Security.OSV: [modelPublished] :: Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific -> Maybe UTCTime
+ Security.OSV: [modelReferences] :: Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific -> [Reference]
+ Security.OSV: [modelRelated] :: Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific -> [Text]
+ Security.OSV: [modelSchemaVersion] :: Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific -> Text
+ Security.OSV: [modelSeverity] :: Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific -> [Severity]
+ Security.OSV: [modelSummary] :: Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific -> Maybe Text
+ Security.OSV: [modelWithdrawn] :: Model dbSpecific affectedEcosystemSpecific affectedDbSpecific rangeDbSpecific -> Maybe UTCTime
+ Security.OSV: [packageEcosystem] :: Package -> Text
+ Security.OSV: [packageName] :: Package -> Text
+ Security.OSV: [packagePurl] :: Package -> Maybe Purl
+ Security.OSV: [referencesType] :: Reference -> ReferenceType
+ Security.OSV: [referencesUrl] :: Reference -> Text
+ Security.OSV: instance GHC.Enum.Bounded Security.OSV.ReferenceType
+ Security.OSV: instance GHC.Enum.Enum Security.OSV.ReferenceType
- Security.OSV: Package :: Text -> Text -> Maybe Text -> Package
+ Security.OSV: Package :: Text -> Text -> Maybe Purl -> Package
Files
- CHANGELOG.md +16/−0
- README.md +7/−0
- osv.cabal +11/−10
- src/Security/OSV.hs +4/−3
CHANGELOG.md view
@@ -0,0 +1,16 @@+# 0.2.0.0++* Rely on `purl` for `Security.OSV.Package.packageUrl`+* Update `tasty` dependency bounds++# 0.1.0.2++* Update dependencies bounds++# 0.1.0.1++* Fix `cvss` dependency bounds++# 0.1.0.0++* Introduction
+ README.md view
@@ -0,0 +1,7 @@+# osv++This project aims to support [Open Source Vulnerability format](https://ossf.github.io/osv-schema/).++## Building++We aim to support both regular cabal-based and nix-based builds.
osv.cabal view
@@ -1,6 +1,6 @@ cabal-version: 2.4 name: osv-version: 0.1.0.0+version: 0.2.0.0 -- A short (one-line) description of the package. synopsis:@@ -15,16 +15,16 @@ -- The license under which the package is released. license: BSD-3-Clause-author: David Christiansen-maintainer: david@davidchristiansen.dk+author: Haskell Security Response Team+maintainer: security-advisories@haskell.org -- A copyright notice. -- copyright: category: Data-extra-doc-files: CHANGELOG.md+extra-doc-files: CHANGELOG.md, README.md tested-with:- GHC ==8.10.7 || ==9.0.2 || ==9.2.8 || ==9.4.8 || ==9.6.3 || ==9.8.1+ GHC ==8.10.7 || ==9.0.2 || ==9.2.8 || ==9.4.8 || ==9.6.6 || ==9.8.3 || ==9.10.1 || ==9.12.1 library exposed-modules:@@ -32,10 +32,11 @@ build-depends: , aeson >=2.0.1.0 && <3- , base >=4.14 && <4.20- , cvss+ , base >=4.14 && <5+ , cvss >=0.2 && <0.3+ , purl >=0.1 && <0.2 , text >=1.2 && <3- , time >=1.9 && <1.14+ , time >=1.9 && <1.15 hs-source-dirs: src default-language: Haskell2010@@ -48,9 +49,9 @@ hs-source-dirs: test main-is: Spec.hs build-depends:- , base <5+ , base , osv- , tasty <1.5+ , tasty <2 , tasty-hunit <0.11 default-language: Haskell2010
src/Security/OSV.hs view
@@ -44,6 +44,7 @@ import Data.Time.Format.ISO8601 (iso8601ParseM) import Data.Tuple (swap) +import Data.Purl (Purl) import qualified Security.CVSS as CVSS data Affected dbSpecific ecosystemSpecific rangeDbSpecific = Affected@@ -182,8 +183,8 @@ data Package = Package { packageName :: Text , packageEcosystem :: Text- , packagePurl :: Maybe Text -- TODO refine type- } deriving (Show, Eq, Ord)+ , packagePurl :: Maybe Purl+ } deriving (Show, Eq) data Range dbSpecific = RangeSemVer [Event Text {- TODO refine -}] (Maybe dbSpecific)@@ -246,7 +247,7 @@ -- @app.any.run@ replaying the exploitation of the vulnerability. | ReferenceTypeWeb -- ^ A web page of some unspecified kind.- deriving (Show, Eq)+ deriving (Show, Eq, Enum, Bounded) -- | Bijection of reference types and their string representations referenceTypes :: [(ReferenceType, Text)]