Clarifying packages for AlmaLinux ecosystem

[Andrew Pollock]

Hi Nikita,

I hope you're well.

With Red Hat's recent onboarding, we were doing some spot checks and looking at  https://osv.dev/vulnerability/CVE-2023-32700 and its aliases, noticed that while https://ossf.github.io/osv-schema/#affectedpackage-field states that the package.name is the source package, looking at https://osv.dev/vulnerability/ALSA-2023:3661 (comparing with https://osv.dev/vulnerability/RLSA-2023:3661) suggests this is not the case.

Should the schema documentation be updated, or the records being published?

regards

Andrew

--

Andrew Pollock Software Engineer, Google Open Source Security Team | apol...@google.com Google LLC