Chainguard Enhances Security With OSV Advisory Feed

By Jordi Mon Companys

In today’s rapidly evolving open source ecosystem, managing vulnerabilities efficiently is crucial. To address this, Chainguard is now publishing its security advisory feed in the Open Source Vulnerabilities (OSV) format. This integration aims to simplify vulnerability management and enhance security for users of open source software.

OSV, an open standard launched by Google in 2021, and now a part of the OpenSSF, simplifies vulnerability reporting for open source maintainers and improves the accuracy of vulnerability queries for downstream consumers. By providing precise metadata in an easy-to-query format, OSV streamlines the process of identifying and addressing security issues in open source software.

About OSV and Its Importance for Chainguard

Adopting the OSV format aligns perfectly with Chainguard’s vision of creating a more secure software ecosystem. We believe that vulnerability management should be an integral part of the open source development process, supported by automated infrastructure. By publishing our security feeds in the OSV format, we’re taking a significant step towards making this vision a reality.

For Chainguard Co-founder and Chief Product Officer, Kim Lewandowski, who authored and helped launch that project at Google in 2021, it has come full circle now that the company she co-founded adopts it. 

Benefits for Container Image Scanners users

Publishing Chainguard’s security advisories in the OSV schema offers several benefits for container image scanners:

1. Standardized, machine-readable format for vulnerability information
2. Improved accuracy with detailed metadata
3. Reduced false positives
4. Faster vulnerability detection
5. Better integration with vulnerability databases
6. Automated vulnerability tracking

Looking Forward

By adopting the OSV format, Chainguard is taking a significant step towards making vulnerability management more accessible and efficient for the open source community. This move is expected to improve the ability of various scanners to analyze Chainguard Images, including potential future support from Google Cloud’s Artifact Analysis and Docker Scout.

We encourage other organizations in the open source ecosystem to consider adopting the OSV format to enhance the overall security posture of the community. 

Read the full announcement in Chainguard’s blog.

About the Author

Jordi is a Product professional interested in supply and dependency chain security and transparency as well as DevOps and Dev tools. He has worked at companies like GitLab or Weaveworks and more recently at the Linux Foundation’s SPDX project. He is now a PMM at Chainguard and a host of Software Engineering Daily.