Add Kubernetes ecosystem #319
Conversation
Signed-off-by: knqyf263 <[email protected]>
| @@ -706,6 +717,7 @@ The defined ecosystems are: | |||
| | `Go` | The Go ecosystem; the `name` field is a Go module path. | | |||
| | `Hackage` | The Haskell package ecosystem. The `name` field is a Haskell package name as published on Hackage. | | |||
| | `Hex` | The package manager for the Erlang ecosystem; the `name` is a Hex package name. | | |||
| | `Kubernetes` | The Kubernetes ecosystem; the `name` field is a Kubernetes component name. | | |||
There was a problem hiding this comment.
Is there some documentation we can point to as an authoritative reference for what a component name is and how to format it?
There was a problem hiding this comment.
To clarify this comment a bit more using your example in kubernetes-sigs/cve-feed-osv#9 (comment):
It's unclear if the name should be "kube-apiserver", or "k8s.io/apiserver". Is there some clarification we can make here on the expected naming scheme?
There was a problem hiding this comment.
Hello @oliverchang, sorry for the late reply. I had been on vacation, and I've missed your comment in accumulated tasks.
Actually, I would like to discuss this point: I thought it would be difficult to distinguish apiserver from non-upstream apiserver if we use apiserver, so I adapted it to Go's module name, like k8s.io/apiserver to clarify it's upstream, but it is not yet strictly defined. How can we distinguish between different flavors within the same ecosystem in the OSV schema?
There was a problem hiding this comment.
We have the convention of having a ":SUFFIX" qualifier for ecosystem names.
For example, for Debian:
The Debian package ecosystem; the name is the name of the source package. The ecosystem string might optionally have a :
<RELEASE>suffix to scope the package to a particular Debian release.<RELEASE>is a numeric version specified in the Debian distro-info-data. For example, the ecosystem string “Debian:7” refers to the Debian 7 (wheezy) release.
Would something similar make sense for Kubernetes?
"Kubernetes" refers to upstream
"Kubernetes:<distribution>" refers to a specific distribution?
There was a problem hiding this comment.
happy new year @knqyf263 !
Just following up on your PR once more :)
| @@ -706,6 +717,7 @@ The defined ecosystems are: | |||
| | `Go` | The Go ecosystem; the `name` field is a Go module path. | | |||
| | `Hackage` | The Haskell package ecosystem. The `name` field is a Haskell package name as published on Hackage. | | |||
| | `Hex` | The package manager for the Erlang ecosystem; the `name` is a Hex package name. | | |||
| | `Kubernetes` | The Kubernetes ecosystem; the `name` field is a Kubernetes component name. | | |||
There was a problem hiding this comment.
To clarify this comment a bit more using your example in kubernetes-sigs/cve-feed-osv#9 (comment):
It's unclear if the name should be "kube-apiserver", or "k8s.io/apiserver". Is there some clarification we can make here on the expected naming scheme?
Adding
Kubernetesecosystem according to the discussion here.This PR does not specify how to handle Kubernetes distributions by cloud vendors like EKS and GKE. We can talk about it here if needed, or merge it once and discuss it separately.