Support Ubuntu vulnerabilities

[fingeromer]

Ubuntu is basically Debian, but it seems like when requesting vulnerabilities with Ubuntu's purl (pkg:deb/ubuntu*) , nothing returns.

[andrewpollock]

Ubuntu is basically Debian

For the purposes of this conversation, only if you squint really really hard :-)

We're converting Debian security advisories to OSV ourselves with https://github.com/ossf/osv-schema/tree/main/tools/debian

We'll need to do something similar (but different) to achieve the same with Ubuntu. I briefly took a look at how Ubuntu rolls, and while also thinking about #1404 and I'm wondering if doing something with both OVAL feeds would be possible (and somewhat reusable).

• https://ubuntu.com/security/oval
• https://security-metadata.canonical.com/oval

It's something we'll have to explore further. Given you filed this and #1404 would you be interested in collaborating with us on this?

[oliverchang]

See #1113 for the data source addition status for Ubuntu.