Vulnerabilities hub: OSV ingestion

Source verification: 0da1a3c784, 2026-10-04 (PCD-283). This replaces the retired Concelier OSV procedure. Its dated original is preserved verbatim. The statements below describe current source, not a live upstream probe.

Follow hub ingestion operations. The current source key is osv; select it in the worker’s configured source list and inspect its actual generations.

stella sources status --json

Input configuration

The current binding is Vulnerabilities:Ingestion:Sources:Osv:EcosystemEndpoints. It is an explicit list of input URIs, not the retired ecosystem-name list or cursor options. An environment-bound first entry is Vulnerabilities__Ingestion__Sources__Osv__EcosystemEndpoints__0.

Each input may contain an OSV ecosystem ZIP archive or a mirror-prepared JSON array of OSV records; the connector detects the format from the content. An empty endpoint list fails closed. The current source options expose no OSV credential field. Use the installation’s chosen endpoints and mirror policy; this page does not select an external provider for it.

The connector reads whole configured inputs. It does not use the predecessor’s per-record modified cursor to avoid the archive download. Check the actual worker result and quarantine counts instead of attempting the retired fetch/parse/map jobs or editing their cursors.

After correcting a confirmed endpoint or availability problem, observe the next worker cycle and follow recovery verification. Keep the selected ecosystems and observed document identities in the coverage record; an OSV completion does not establish that every advisory from a retired vendor/GHSA source is present.

Re-verify

Read src/Vulnerabilities/__Libraries/StellaOps.Vulnerabilities.Ingestion/Connectors/OsvSourceConnector.cs and the binding in its parent ServiceCollectionExtensions.cs. The common operations page provides the current owner routes and executable CLI syntax check. A source-only review does not prove installed-feed freshness.

Source check: git show HEAD:src/Vulnerabilities/__Libraries/StellaOps.Vulnerabilities.Ingestion/Connectors/OsvSourceConnector.cs.