rustsec reported date is being used as published date

[jayvdb]

Describe the bug
The RUSTSEC reported date is not the published date - the "issued" field is a closer concept.

To Reproduce
Steps to reproduce the behaviour:

1. Go to https://rustsec.org/advisories/RUSTSEC-2024-0388
2. See it says "Issued: November 10, 2024" which is when derivative is unmaintained rustsec/advisory-db#1987 / Assigned RUSTSEC-2024-0388 to derivative rustsec/advisory-db#2119 occurred
3. Click on JSON (OSV)
4. See it includes "published":"2024-06-26T12:00:00Z" , which is when derivative is unmaintained rustsec/advisory-db#1987 was first created.

Expected behaviour
I believe the published field in osv.dev should be the issued date from RUSTSEC

Screenshots

Additional context

[andrewpollock]

Hi,

Using RUSTSEC-2024-0388 as the full worked example...

• https://rustsec.org/advisories/RUSTSEC-2024-0388 is the human-readable record
  • Reported June 26, 2024
  • Issued November 10, 2024
• https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2024-0388.json is the record imported by OSV.dev
  • "published": "2024-06-26T12:00:00Z"
  • "modified": "2024-11-10T13:34:40Z",
• https://api.osv.dev/v1/vulns/RUSTSEC-2024-0388 is the record as it exists in OSV.dev
  • published: "2024-06-26T12:00:00Z"
  • modified: "2024-11-10T13:34:40Z"

I believe the published field in osv.dev should be the issued date from RUSTSEC

I'm inclined to agree, however this is incumbent on RUST Advisory Database to being publishing their records this way.

[github-actions]

This issue has not had any activity for 60 days and will be automatically closed in two weeks

See https://github.com/google/osv.dev/blob/master/CONTRIBUTING.md for how to contribute a PR if you're interested in helping out.

[oliverchang]

Closing since the discussion is tracked in rustsec/advisory-db#2130