diff --git a/docs/schema.md b/docs/schema.md index 6cdb8b0..fca0393 100644 --- a/docs/schema.md +++ b/docs/schema.md @@ -692,33 +692,33 @@ The defined ecosystems are: |-----------|-------------| | `AlmaLinux` | AlmaLinux package ecosystem; the `name` is the name of the source package. The ecosystem string might optionally have a `:` suffix to scope the package to a particular AlmaLinux release. `` is a numeric version. | | `Alpine` | The Alpine package ecosystem; the `name` is the name of the source package. The ecosystem string must have a `:v` suffix to scope the package to a particular Alpine release branch (the `v` prefix is required). E.g. `v3.16`. | -| `Android` | The Android ecosystem. Android organizes code using [`repo` tool](https://gerrit.googlesource.com/git-repo/+/HEAD/README.md), which manages multiple git projects under one or more remote git servers, where each project is identified by its name in [repo configuration](https://gerrit.googlesource.com/git-repo/+/HEAD/docs/manifest-format.md#Element-project) (e.g. `platform/frameworks/base`). The `name` field should contain the name of that affected git project/submodule. One exception is when the project contains the Linux kernel source code, in which case `name` field will be `:linux_kernel:`, followed by an optional SoC vendor name e.g. `:linux_kernel:Qualcomm`. The list of recognized SoC vendors is listed in the [Appendix](#android-soc-vendors) | +| `Android` | The Android ecosystem. Android organizes code using [`repo` tool](https://gerrit.googlesource.com/git-repo/+/HEAD/README.md), which manages multiple git projects under one or more remote git servers, where each project is identified by its name in [repo configuration](https://gerrit.googlesource.com/git-repo/+/HEAD/docs/manifest-format.md#Element-project) (e.g. `platform/frameworks/base`). The `name` field should contain the name of that affected git project/submodule. One exception is when the project contains the Linux kernel source code, in which case `name` field will be `:linux_kernel:`, followed by an optional SoC vendor name e.g. `:linux_kernel:Qualcomm`. The list of recognized SoC vendors is listed in the [Appendix](#android-soc-vendors) | | `Bioconductor` | The biological R package ecosystem. The `name` is an R package name. | | `Bitnami` | Bitnami package ecosystem; the `name` is the name of the affected component. | | `Chainguard` | The Chainguard package ecosystem; the `name` is the name of the package. | -| `ConanCenter` | The ConanCenter ecosystem for C and C++; the `name` field is a Conan package name. | +| `ConanCenter` | The ConanCenter ecosystem for C and C++; the `name` field is a Conan package name. | | `CRAN` | The R package ecosystem. The `name` is an R package name. | -| `crates.io` | The crates.io ecosystem for Rust; the `name` field is a crate name. | -| `Debian` | The Debian package ecosystem; the `name` is the name of the source package. The ecosystem string might optionally have a `:` suffix to scope the package to a particular Debian release. `` is a numeric version specified in the [Debian distro-info-data](https://debian.pages.debian.net/distro-info-data/debian.csv). For example, the ecosystem string "Debian:7" refers to the Debian 7 (wheezy) release. | -| `GHC` | The Haskell compiler ecosystem. The `name` field is the name of a component of the GHC compiler ecosystem (e.g., compiler, GHCI, RTS). | +| `crates.io` | The crates.io ecosystem for Rust; the `name` field is a crate name. | +| `Debian` | The Debian package ecosystem; the `name` is the name of the source package. The ecosystem string might optionally have a `:` suffix to scope the package to a particular Debian release. `` is a numeric version specified in the [Debian distro-info-data](https://debian.pages.debian.net/distro-info-data/debian.csv). For example, the ecosystem string "Debian:7" refers to the Debian 7 (wheezy) release. | +| `GHC` | The Haskell compiler ecosystem. The `name` field is the name of a component of the GHC compiler ecosystem (e.g., compiler, GHCI, RTS). | | `GitHub Actions` | The GitHub Actions ecosystem; the `name` field is the action's repository name with owner e.g. `{owner}/{repo}`. | -| `Go` | The Go ecosystem; the `name` field is a Go module path. | -| `Hackage` | The Haskell package ecosystem. The `name` field is a Haskell package name as published on Hackage. | -| `Hex` | The package manager for the Erlang ecosystem; the `name` is a Hex package name. | +| `Go` | The Go ecosystem; the `name` field is a Go module path. | +| `Hackage` | The Haskell package ecosystem. The `name` field is a Haskell package name as published on Hackage. | +| `Hex` | The package manager for the Erlang ecosystem; the `name` is a Hex package name. | | `Linux` | The Linux kernel. The only supported `name` is `Kernel`. | | `Mageia` | The Mageia Linux package ecosystem; the `name` is the name of the source package. The ecosystem string must have a `:` suffix to scope the package to a particular Mageia release. Eg `Mageia:9`. | | `Maven` | The Maven Java package ecosystem. The `name` field is a Maven package name in the format `groupId:artifactId`. The ecosystem string might optionally have a `:` suffix to denote the remote repository URL that best represents the source of truth for this package, without a trailing slash (e.g. `Maven:https://maven.google.com`). If this is omitted, this is assumed to be the Maven Central repository (`https://repo.maven.apache.org/maven2`). | -| `npm` | The NPM ecosystem; the `name` field is an NPM package name. | -| `NuGet` | The NuGet package ecosystem. The `name` field is a NuGet package name. | -| `OSS-Fuzz` | For reports from the OSS-Fuzz project that have no more appropriate ecosystem; the `name` field is the name assigned by the OSS-Fuzz project, as recorded in the submitted fuzzing configuration. | +| `npm` | The NPM ecosystem; the `name` field is an NPM package name. | +| `NuGet` | The NuGet package ecosystem. The `name` field is a NuGet package name. | | `openSUSE` | The openSUSE ecosystem; The ecosystem string has a `:` suffix presenting the marketing name of the openSUSE distribution. `` matches the value in the `/etc/os-release` `PRETTY_NAME` field. The `name` field is the name of the source RPM and accompanied by a purl. There is an `ecosystem_specific` specific array `binaries` of the associated RPM binary packages in this specific openSUSE distribution. The ECOSYSTEM version ordering is the RPM versioncompare ordering, and the database uses the `introduced` and `fixed` boundaries. | -| `Packagist` | The PHP package manager ecosystem; the `name` is a package name. | +| `OSS-Fuzz` | For reports from the OSS-Fuzz project that have no more appropriate ecosystem; the `name` field is the name assigned by the OSS-Fuzz project, as recorded in the submitted fuzzing configuration. | +| `Packagist` | The PHP package manager ecosystem; the `name` is a package name. | | `Photon OS` | The Photon OS package ecosystem; the `name` is the name of the RPM package. The ecosystem string must have a `:` suffix to scope the package to a particular Photon OS release. Eg `Photon OS:3.0`. | | `Pub` | The package manager for the Dart ecosystem; the `name` field is a Dart package name. | -| `PyPI` | the Python PyPI ecosystem; the `name` field is a [normalized](https://www.python.org/dev/peps/pep-0503/#normalized-names) PyPI package name. | -| `Red Hat` | The Red Hat package ecosystem; the `name` field is the name of a binary or source RPM. The ecosystem string has a `:` suffix to scope the RPM to a specific Red Hat product stream. `` is a translation of a Red Hat [Common Platform Enumerations](https://cpe.mitre.org/) (CPE) with the `cpe/:[oa]:(redhat):` prefix removed (for example, `Red Hat:rhel_aus:8.4::appstream` translates to `cpe:/a:redhat:rhel_aus:8.4::appstream`). Red Hat ecosystem identifiers can be used to identify vulnerable RPMs installed on a Red Hat system as explained [here](https://www.redhat.com/en/blog/how-accurately-match-oval-security-data-installed-rpms). | +| `PyPI` | the Python PyPI ecosystem; the `name` field is a [normalized](https://www.python.org/dev/peps/pep-0503/#normalized-names) PyPI package name. | +| `Red Hat` | The Red Hat package ecosystem; the `name` field is the name of a binary or source RPM. The ecosystem string has a `:` suffix to scope the RPM to a specific Red Hat product stream. `` is a translation of a Red Hat [Common Platform Enumerations](https://cpe.mitre.org/) (CPE) with the `cpe/:[oa]:(redhat):` prefix removed (for example, `Red Hat:rhel_aus:8.4::appstream` translates to `cpe:/a:redhat:rhel_aus:8.4::appstream`). Red Hat ecosystem identifiers can be used to identify vulnerable RPMs installed on a Red Hat system as explained [here](https://www.redhat.com/en/blog/how-accurately-match-oval-security-data-installed-rpms). | | `Rocky Linux` | The Rocky Linux package ecosystem; the `name` is the name of the source package. The ecosystem string might optionally have a `:` suffix to scope the package to a particular Rocky Linux release. `` is a numeric version. | -| `RubyGems` | The RubyGems ecosystem; the `name` field is a gem name. | +| `RubyGems` | The RubyGems ecosystem; the `name` field is a gem name. | | `SUSE` | The SUSE ecosystem; The ecosystem string has a `:` suffix representing the marketing name of the SUSE product. `` matches the value in the /etc/os-release `PRETTY_NAME` field. The `name` field is the name of the source RPM and accompanied by a purl. There is a `ecosystem_specific` specific array `binaries` of the associated RPM binary packages in this specific SUSE product. The ECOSYSTEM version ordering is the RPM versioncompare ordering, and the database uses the `introduced` and `fixed` boundaries. | | `SwiftURL` | The Swift Package Manager ecosystem. The `name` is a Git URL to the source of the package. Versions are Git tags that comform to [SemVer 2.0](https://docs.swift.org/package-manager/PackageDescription/PackageDescription.html#version). | | `Ubuntu` | The Ubuntu package ecosystem; the `name` field is the name of the source package. The ecosystem string has a `:` suffix to scope the package to a particular Ubuntu release. `` is a numeric ("YY.MM") version as specified in [Ubuntu Releases](https://wiki.ubuntu.com/Releases), with a mandatory `:LTS` suffix if the release is marked as LTS. The release version may also be prefixed with `:Pro:` to denote Ubuntu Pro (aka Expanded Security Maintenance (ESM)) updates. For example, the ecosystem string "Ubuntu:22.04:LTS" refers to Ubuntu 22.04 LTS (jammy), while "Ubuntu:Pro:18.04:LTS" refers to fixes that landed in Ubuntu 18.04 LTS (bionic) under Ubuntu Pro/ESM. | diff --git a/ecosystems.json b/ecosystems.json index 6f4599f..907fbee 100644 --- a/ecosystems.json +++ b/ecosystems.json @@ -1,33 +1,33 @@ { "AlmaLinux": "AlmaLinux package ecosystem; the `name` is the name of the source package. The ecosystem string might optionally have a `:` suffix to scope the package to a particular AlmaLinux release. `` is a numeric version.", "Alpine": "The Alpine package ecosystem; the `name` is the name of the source package. The ecosystem string must have a `:v` suffix to scope the package to a particular Alpine release branch (the `v` prefix is required). E.g. `v3.16`.", - "Android": " The Android ecosystem. Android organizes code using [`repo` tool](https://gerrit.googlesource.com/git-repo/+/HEAD/README.md), which manages multiple git projects under one or more remote git servers, where each project is identified by its name in [repo configuration](https://gerrit.googlesource.com/git-repo/+/HEAD/docs/manifest-format.md#Element-project) (e.g. `platform/frameworks/base`). The `name` field should contain the name of that affected git project/submodule. One exception is when the project contains the Linux kernel source code, in which case `name` field will be `:linux_kernel:`, followed by an optional SoC vendor name e.g. `:linux_kernel:Qualcomm`. The list of recognized SoC vendors is listed in the [Appendix](#android-soc-vendors)", + "Android": "The Android ecosystem. Android organizes code using [`repo` tool](https://gerrit.googlesource.com/git-repo/+/HEAD/README.md), which manages multiple git projects under one or more remote git servers, where each project is identified by its name in [repo configuration](https://gerrit.googlesource.com/git-repo/+/HEAD/docs/manifest-format.md#Element-project) (e.g. `platform/frameworks/base`). The `name` field should contain the name of that affected git project/submodule. One exception is when the project contains the Linux kernel source code, in which case `name` field will be `:linux_kernel:`, followed by an optional SoC vendor name e.g. `:linux_kernel:Qualcomm`. The list of recognized SoC vendors is listed in the [Appendix](#android-soc-vendors)", "Bioconductor": "The biological R package ecosystem. The `name` is an R package name.", "Bitnami": "Bitnami package ecosystem; the `name` is the name of the affected component.", "Chainguard": "The Chainguard package ecosystem; the `name` is the name of the package.", - "ConanCenter": "The ConanCenter ecosystem for C and C++; the `name` field is a Conan package name. ", + "ConanCenter": "The ConanCenter ecosystem for C and C++; the `name` field is a Conan package name.", "CRAN": "The R package ecosystem. The `name` is an R package name.", - "crates.io": "The crates.io ecosystem for Rust; the `name` field is a crate name. ", - "Debian": "The Debian package ecosystem; the `name` is the name of the source package. The ecosystem string might optionally have a `:` suffix to scope the package to a particular Debian release. `` is a numeric version specified in the [Debian distro-info-data](https://debian.pages.debian.net/distro-info-data/debian.csv). For example, the ecosystem string \"Debian:7\" refers to the Debian 7 (wheezy) release. ", - "GHC": "The Haskell compiler ecosystem. The `name` field is the name of a component of the GHC compiler ecosystem (e.g., compiler, GHCI, RTS). ", + "crates.io": "The crates.io ecosystem for Rust; the `name` field is a crate name.", + "Debian": "The Debian package ecosystem; the `name` is the name of the source package. The ecosystem string might optionally have a `:` suffix to scope the package to a particular Debian release. `` is a numeric version specified in the [Debian distro-info-data](https://debian.pages.debian.net/distro-info-data/debian.csv). For example, the ecosystem string \"Debian:7\" refers to the Debian 7 (wheezy) release.", + "GHC": "The Haskell compiler ecosystem. The `name` field is the name of a component of the GHC compiler ecosystem (e.g., compiler, GHCI, RTS).", "GitHub Actions": "The GitHub Actions ecosystem; the `name` field is the action's repository name with owner e.g. `{owner}/{repo}`.", - "Go": "The Go ecosystem; the `name` field is a Go module path. ", - "Hackage": "The Haskell package ecosystem. The `name` field is a Haskell package name as published on Hackage. ", - "Hex": "The package manager for the Erlang ecosystem; the `name` is a Hex package name. ", + "Go": "The Go ecosystem; the `name` field is a Go module path.", + "Hackage": "The Haskell package ecosystem. The `name` field is a Haskell package name as published on Hackage.", + "Hex": "The package manager for the Erlang ecosystem; the `name` is a Hex package name.", "Linux": "The Linux kernel. The only supported `name` is `Kernel`.", "Mageia": "The Mageia Linux package ecosystem; the `name` is the name of the source package. The ecosystem string must have a `:` suffix to scope the package to a particular Mageia release. Eg `Mageia:9`.", "Maven": "The Maven Java package ecosystem. The `name` field is a Maven package name in the format `groupId:artifactId`. The ecosystem string might optionally have a `:` suffix to denote the remote repository URL that best represents the source of truth for this package, without a trailing slash (e.g. `Maven:https://maven.google.com`). If this is omitted, this is assumed to be the Maven Central repository (`https://repo.maven.apache.org/maven2`).", - "npm": "The NPM ecosystem; the `name` field is an NPM package name. ", - "NuGet": "The NuGet package ecosystem. The `name` field is a NuGet package name. ", - "OSS-Fuzz": "For reports from the OSS-Fuzz project that have no more appropriate ecosystem; the `name` field is the name assigned by the OSS-Fuzz project, as recorded in the submitted fuzzing configuration. ", + "npm": "The NPM ecosystem; the `name` field is an NPM package name.", + "NuGet": "The NuGet package ecosystem. The `name` field is a NuGet package name.", "openSUSE": "The openSUSE ecosystem; The ecosystem string has a `:` suffix presenting the marketing name of the openSUSE distribution. `` matches the value in the `/etc/os-release` `PRETTY_NAME` field. The `name` field is the name of the source RPM and accompanied by a purl. There is an `ecosystem_specific` specific array `binaries` of the associated RPM binary packages in this specific openSUSE distribution. The ECOSYSTEM version ordering is the RPM versioncompare ordering, and the database uses the `introduced` and `fixed` boundaries.", - "Packagist": "The PHP package manager ecosystem; the `name` is a package name. ", + "OSS-Fuzz": "For reports from the OSS-Fuzz project that have no more appropriate ecosystem; the `name` field is the name assigned by the OSS-Fuzz project, as recorded in the submitted fuzzing configuration.", + "Packagist": "The PHP package manager ecosystem; the `name` is a package name.", "Photon OS": "The Photon OS package ecosystem; the `name` is the name of the RPM package. The ecosystem string must have a `:` suffix to scope the package to a particular Photon OS release. Eg `Photon OS:3.0`.", "Pub": "The package manager for the Dart ecosystem; the `name` field is a Dart package name.", - "PyPI": "the Python PyPI ecosystem; the `name` field is a [normalized](https://www.python.org/dev/peps/pep-0503/#normalized-names) PyPI package name. ", - "Red Hat": "The Red Hat package ecosystem; the `name` field is the name of a binary or source RPM. The ecosystem string has a `:` suffix to scope the RPM to a specific Red Hat product stream. `` is a translation of a Red Hat [Common Platform Enumerations](https://cpe.mitre.org/) (CPE) with the `cpe/:[oa]:(redhat):` prefix removed (for example, `Red Hat:rhel_aus:8.4::appstream` translates to `cpe:/a:redhat:rhel_aus:8.4::appstream`). Red Hat ecosystem identifiers can be used to identify vulnerable RPMs installed on a Red Hat system as explained [here](https://www.redhat.com/en/blog/how-accurately-match-oval-security-data-installed-rpms). ", + "PyPI": "the Python PyPI ecosystem; the `name` field is a [normalized](https://www.python.org/dev/peps/pep-0503/#normalized-names) PyPI package name.", + "Red Hat": "The Red Hat package ecosystem; the `name` field is the name of a binary or source RPM. The ecosystem string has a `:` suffix to scope the RPM to a specific Red Hat product stream. `` is a translation of a Red Hat [Common Platform Enumerations](https://cpe.mitre.org/) (CPE) with the `cpe/:[oa]:(redhat):` prefix removed (for example, `Red Hat:rhel_aus:8.4::appstream` translates to `cpe:/a:redhat:rhel_aus:8.4::appstream`). Red Hat ecosystem identifiers can be used to identify vulnerable RPMs installed on a Red Hat system as explained [here](https://www.redhat.com/en/blog/how-accurately-match-oval-security-data-installed-rpms).", "Rocky Linux": "The Rocky Linux package ecosystem; the `name` is the name of the source package. The ecosystem string might optionally have a `:` suffix to scope the package to a particular Rocky Linux release. `` is a numeric version.", - "RubyGems": "The RubyGems ecosystem; the `name` field is a gem name. ", + "RubyGems": "The RubyGems ecosystem; the `name` field is a gem name.", "SUSE": "The SUSE ecosystem; The ecosystem string has a `:` suffix representing the marketing name of the SUSE product. `` matches the value in the /etc/os-release `PRETTY_NAME` field. The `name` field is the name of the source RPM and accompanied by a purl. There is a `ecosystem_specific` specific array `binaries` of the associated RPM binary packages in this specific SUSE product. The ECOSYSTEM version ordering is the RPM versioncompare ordering, and the database uses the `introduced` and `fixed` boundaries.", "SwiftURL": "The Swift Package Manager ecosystem. The `name` is a Git URL to the source of the package. Versions are Git tags that comform to [SemVer 2.0](https://docs.swift.org/package-manager/PackageDescription/PackageDescription.html#version).", "Ubuntu": "The Ubuntu package ecosystem; the `name` field is the name of the source package. The ecosystem string has a `:` suffix to scope the package to a particular Ubuntu release. `` is a numeric (\"YY.MM\") version as specified in [Ubuntu Releases](https://wiki.ubuntu.com/Releases), with a mandatory `:LTS` suffix if the release is marked as LTS. The release version may also be prefixed with `:Pro:` to denote Ubuntu Pro (aka Expanded Security Maintenance (ESM)) updates. For example, the ecosystem string \"Ubuntu:22.04:LTS\" refers to Ubuntu 22.04 LTS (jammy), while \"Ubuntu:Pro:18.04:LTS\" refers to fixes that landed in Ubuntu 18.04 LTS (bionic) under Ubuntu Pro/ESM.", diff --git a/scripts/update-ecosystems-lists.py b/scripts/update-ecosystems-lists.py index 420d6c3..da63814 100755 --- a/scripts/update-ecosystems-lists.py +++ b/scripts/update-ecosystems-lists.py @@ -5,7 +5,16 @@ MARKDOWN_TABLE_MARKER_START = '' MARKDOWN_TABLE_MARKER_END = '' -ecosystems: dict[str, str] = json.loads(open('ecosystems.json').read()) +# ensure that the ecosystems are sorted alphabetically and don't have extra whitespace +ecosystems: dict[str, str] = { + k: v.strip() for k, v in sorted( + json.loads(open('ecosystems.json').read()).items(), + key=lambda item: item[0].casefold() + ) +} + +# write back to the json file in case there were any changes +open('ecosystems.json', 'w').write(json.dumps(ecosystems, indent=2) + '\n') def update_json_schema():