Vulnerability intelligence and matching
Implemented Advisory ingestion and persistence.
Planned Matching installed software to vulnerability findings.
Intelligence ingestion
advisory-importer reads configured OSV distribution exports, translates supported records, stamps provenance, and publishes to security.advisories. It is the backend process with external feed network access and owns no asset store. advisory-writer persists every advisory version, affected-package entries, and synchronization attempts in ClickHouse.
Supported distribution families in this baseline are Debian, Ubuntu, Alpine, Rocky Linux, and AlmaLinux. Ecosystems include the release, such as Debian:12; comparing a package without its distribution release can produce an invalid conclusion.
Identity and provenance
An advisory is named by source and source ID; a version is tied to source modification time. The platform records feed identity, index version, source URL, fetch time, raw-byte SHA-256, source format, and translation rules. A feed cannot supply authoritative provenance about its own transport.
Aliases mean the same vulnerability. Upstream IDs describe derivation and must not be merged as if they were aliases. Source severity vectors or ratings are preserved; this pipeline does not calculate its own universal score.
Freshness and withdrawal
A failed fetch does not erase held intelligence or advance the last successful complete synchronization. An advisory absent from a later listing is retained; only an explicit source withdrawal marks it withdrawn. Both the time the platform last synchronized and the age of the source's newest listed material matter.
Planned matching
Matching is the next capability, not a hidden function of the importer. It should connect current inventory to affected packages through the shared package-key semantics and ecosystem-specific version ordering. A distribution the platform cannot assess, stale intelligence, or an incomplete scan must not read as “no vulnerabilities.” No vulnerability finding API or remediation workflow is claimed in this baseline.
Use feed operations to inspect current freshness, and the advisory contract for exact fields.
Source evidence
Reviewed against the source baseline. Seagull-backend-v2/docs/decisions/0028-vulnerability-intelligence-is-read-from-its-source.md · Seagull-backend-v2/internal/advisoryfeed/importer.go · Seagull-backend-v2/internal/osv/translate.go · Seagull-backend-v2/notes/be-035-handoff.md (local planning evidence).