Fetching vulnerabilities via api for ubuntu packages by purl with version does not work

[Andre-85]

Hello everyone,
I tried to fetch vulnerabilities via api with the purl (Package URL). The SBOM from which I am extracting the packages, the purl has following format: pkg:deb/ubuntu/PACKAGE_NAME@VERSION.

What I've tested:

1. the api works with purls like this for e.g. maven packages. Test:
   curl -d '{"package": {"purl": "pkg:maven/org.apache.struts/[email protected]"}}' https://api.osv.dev/v1/query
2. Ubuntu purls work if i know the arch and the distribution. Test:
   curl -d '{"package": {"purl": "pkg:deb/ubuntu/ruby-sinatra?arch=src?distro=jammy"}}' https://api.osv.dev/v1/query
3. It works if I split the purl in package-name, version, namespace(==ecosystem). Test:
   curl -d '{"package": {"name": "atftp"}, "version": "0.7.git20120829-3.1~0.18.04.1", ecosystem: "ubuntu"}' https://api.osv.dev/v1/query
4. But giving the purl only for the same package and version like in 3., returns nothing. Test:
   curl -d '{"package": {"purl": "pkg:deb/ubuntu/[email protected]~0.18.04.1"}}' https://api.osv.dev/v1/query
5. Additionally i found out that this works for debian packages coming directly from Debian. Test:
   curl -d '{"package": {"purl": "pkg:deb/debian/[email protected]+deb10u3"}}' https://api.osv.dev/v1/query

Right now I use (3.) as a workaround, but i would be nice if it could work like (1.).Thank you very much for your help in advance.Greetings,
André

[cuixq]

@hogo6002 can you help to answer this?

[Andre-85]

If you could help this would be great. Meanwhile it tried to understand how the osv.dev service works. My plan was to run a api-server in a Docker/Podman container and test patches on it and connect it to osv.dev database in the internet. Setting up with Podman works:
`
podman build --file gcp/api/Dockerfile -t osv-api .
podman run -p 8000:8000 osv-api:latest

`
But because of missing/wrong ndb credentials I cannot connect to osv.dev database. Did I do a mistake or is such a test setup not possible at all because the access to the database itself is private to google's osv.dev service?

[hogo6002]

Hi @Andre-85, thanks for reporting this issue!

But because of missing/wrong ndb credentials I cannot connect to osv.dev database. Did I do a mistake or is such a test setup not possible at all because the access to the database itself is private to google's osv.dev service?

You didn't make any mistakes, and this is by design. Currently, only we can set up the API locally because it requires the ndb credentials.

The issue is due to the ecosystem being falsely parsed from the PURL in OSV. We currently get the ecosystem name from purl.type, which works for project ecosystems such as npm and Maven. However, for Linux distributions, several ecosystems may use the same package management system. For example, both Debian and Ubuntu use Debian package management, and the purl.type here would be deb, so we treated the Ubuntu query as a Debian version query. This is why the version query works with Debian but not with Ubuntu (we perform an ecosystem check for version queries).

PURL spec: scheme:type/namespace/name@version?qualifiers#subpath

To solve this, we will use purl.namespace to get the ecosystem for Linux distributions.
Thanks again for reporting this with a detailed explanation of the problem. A fix will be coming soon!

[Andre-85]

That's great news! I can't wait for testing it!

Thank you very much 👍