Skip to content
/ rosv Public

R package for working with Open Source Vulnerabilities database

License

Unknown, MIT licenses found

Licenses found

Unknown
LICENSE
MIT
LICENSE.md
Notifications You must be signed in to change notification settings

al-obrien/rosv

Repository files navigation

rosv rosv website

CRAN status CRAN checks R-CMD-check Codecov test coverage Dependencies

Overview

The {rosv} package is an API client to the Open Source Vulnerability (OSV) database. Both high and low level functions are available to query the database for vulnerabilities in package repositories across various open source ecosystems such as CRAN, Bioconductor, PyPI, and many more. Queries made against the OSV database are useful to check for package vulnerabilities (including by specific versions) enumerated in package management files such as requirements.txt (Python) and renv.lock (R). Checking valid query construction, API response pagination, and parsing content are all handled by {rosv}.

Various helper functions assist in the administration of Posit Package Manager or similar services. Packages can be routinely examined for new vulnerabilities which aide in the creation and updating of curated repositories as well as assigning block lists.

More details about the OSV project and associated API can be found here: https://google.github.io/osv.dev/.

Installation

install.packages('rosv')
library(rosv)

For the latest development version, you can install {rosv} from GitHub:

remotes::install_github('al-obrien/rosv')

Basic usage

The fastest and simplest way to get started with {rosv} is to use the osv_query() function.

  1. Provide a package name and related ecosystem to fetch any identified vulnerabilities.

    osv_query('dask', ecosystem = 'PyPI')
  2. Query multiple packages at the same time and across ecosystems.

    osv_query(c('dask', 'readxl', 'dplyr'),
              ecosystem = c('PyPI', 'CRAN', 'CRAN'))
  3. Return results only for packages provided and not others that may be part of the same vulnerability.

    osv_query('apache-airflow', ecosystem = 'PyPI', all_affected = FALSE)
  4. Download all vulnerabilities listed for an ecosystem.

    osv_query(ecosystem = 'CRAN', all_affected = FALSE)

Development notes

{rosv} leverages {httr2} and {httptest2} for its core API client functionality and uses R6 classes for its low-level interface to the OSV API. There are also plans to have more types of returned details and parsing of content.

About

R package for working with Open Source Vulnerabilities database

Resources

License

Unknown, MIT licenses found

Licenses found

Unknown
LICENSE
MIT
LICENSE.md

Stars

Watchers

Forks

Packages

No packages published

Languages