[Samk1710]

Addresses Issue:

• Import data from Tuxcare #2004

Data Source: https://osv-vulnerabilities.storage.googleapis.com/TuxCare/all.zip

Importer Log Excerpt:

python manage.py import tuxcare_importer_v2
Importing data using tuxcare_importer_v2
INFO 2026-10-22 09:47:23.518176 UTC Pipeline [TuxCareImporterPipeline] starting
INFO 2026-10-22 09:47:23.518356 UTC Step [fetch_zip] starting
INFO 2026-10-22 09:47:23.518440 UTC Fetching `https://osv-vulnerabilities.storage.googleapis.com/TuxCare/all.zip`
INFO 2026-10-22 09:47:27.134942 UTC Step [fetch_zip] completed in 4 seconds
INFO 2026-10-22 09:47:27.135528 UTC Step [collect_and_store_advisories] starting
INFO 2026-10-22 09:47:27.284310 UTC Collecting 17,688 advisories
INFO 2026-10-22 09:50:21.282477 UTC Progress: 10% (1769/17688) ETA: 1566 seconds (26.1 minutes)
INFO 2026-10-22 09:53:23.097456 UTC Progress: 20% (3538/17688) ETA: 1423 seconds (23.7 minutes)
INFO 2026-10-22 09:55:57.992284 UTC Progress: 30% (5307/17688) ETA: 1192 seconds (19.9 minutes)
INFO 2026-10-22 09:58:54.480809 UTC Progress: 40% (7076/17688) ETA: 1031 seconds (17.2 minutes)
INFO 2026-10-22 10:02:57.503693 UTC Progress: 50% (8844/17688) ETA: 930 seconds (15.5 minutes)
INFO 2026-10-22 10:05:37.188014 UTC Progress: 60% (10613/17688) ETA: 727 seconds (12.1 minutes)
INFO 2026-10-22 10:06:26.311517 UTC Progress: 70% (12382/17688) ETA: 488 seconds (8.1 minutes)
INFO 2026-10-22 10:07:17.769579 UTC Progress: 80% (14151/17688) ETA: 298 seconds (5.0 minutes)
INFO 2026-10-22 10:08:05.944168 UTC Progress: 90% (15920/17688) ETA: 138 seconds (2.3 minutes)
INFO 2026-10-22 10:09:13.021113 UTC Progress: 100% (17688/17688)
INFO 2026-10-22 10:09:13.051267 UTC Successfully collected 17,688 advisories
INFO 2026-10-22 10:09:13.051511 UTC Step [collect_and_store_advisories] completed in 1306 seconds (21.8 minutes)
INFO 2026-10-22 10:09:13.051590 UTC Pipeline completed in 1310 seconds (21.8 minutes)

[ziadhany]

@Samk1710 Thanks , see feedback and suggestions below

[Samk1710]

@ziadhany Thanks for your review.
I have updated the code as per your suggestion and feedback. Requesting a re-review. Thanks again!

[ziadhany]

@Samk1710, could you please also fix the CI ?

[Samk1710]

Hey @ziadhany
I have updated the implementation as per your review and suggestion of os_name qualifier. Do let me know if it aligns with what you had in mind. Thanks !

[Samk1710]

Hey @ziadhany
I have refactored the purl as per your suggestion and pushed. Thanks for the guidance :)

[Samk1710]

@Samk1710, could you please also fix the CI ?

Hey @ziadhany could you kindly run the checks. I have fixed the import ordering. Thanks.

[ziadhany]

@Samk1710 , The code looks good. I think we just need some refinement of the package URL and the affected and fixed versions.

[Samk1710]

Hey @ziadhany

I have rectified the PURL. Also added more data to test each OS type with their respective PURLs.
After some digging in I also found the documentation for statuses and also implemented them.
Please see #2104 (comment)

Kindly review the changes when you have time. Thanks.

[Samk1710]

Hey @ziadhany
As per discussions in the weekly meet, I have implemented the Impact Packages and also mapped the version range.
Kindly take a look at them and let me know if anything has to be improved. Please review when time. Thanks.

[ziadhany]

The code looks good, just a few nits.

[Samk1710]

The code looks good, just a few nits.

Thanks @ziadhany
I’ve addressed the review comments and pushed the latest changes.
Please let me know if anything else needs adjustment.

[Samk1710]

Hey @ziadhany. Could you kindly have a look at the changes when time. Thanks.

[ziadhany]

@Samk1710, just a few nits to improve code quality and update the importer to use AdvisoryDataV2. Overall, the code looks good.

[Samk1710]

@ziadhany Done with the changes. Please have a look when time

[Samk1710]

The new endpoint at https://tuxcare.com/cve-tracker/api/cves/export/json is workable although the PURL resolution might be a bit difficult.

Old advisory

  {
    "cve": "CVE-2023-52922",
    "os_name": "CentOS 8.5 ELS",
    "project_name": "kernel",
    "version": "4.18.0",
    "score": "7.8",
    "severity": "HIGH",
    "status": "Released",
    "last_updated": "2025-05-21 01:43:28.677045"
  }

Sample New Advisory

{
  "cve": "CVE-2026-59797",
  "product": "CentOS 6 ELS",
  "component": "httpd",
  "version": "2.2.15",
  "severity": "Critical",
  "status": "In Research",
  "published_date": "2026-10-01",
  "type": null
}

Currently we were using in https://github.com/aboutcode-org/vulnerablecode/pull/2104/changes#diff-11b0ceee4d3520186d775bd38d8898718ba0b40cea97007fff7dfe0f1fa5737a

        os_mapping = {
            "ubuntu": ("deb", "ubuntu"),
            "debian": ("deb", "debian"),
            "centos": ("rpm", "centos"),
            "almalinux": ("rpm", "almalinux"),
            "rhel": ("rpm", "rhel"),
            "oracle": ("rpm", "oracle"),
            "cloudlinux": ("rpm", "cloudlinux"),
            "alpine": ("apk", "alpine"),
            "unknown": ("generic", "tuxcare"),
            "tuxcare": ("generic", "tuxcare"),
        }

But now Tuxcare has 6814 unique products. This mapping alone will not suffice. See the gist for product frequencies here https://gist.github.com/Samk1710/0229b9dd41a66ba414dbed0464f24428.

Also CVE-2017-20162 alone has 30149 records which is unusual.

These are the top CVEs and their count

CVE-2017-20162: 30149
CVE-2017-16137: 29674
CVE-2017-20165: 29629
CVE-2018-8088: 27253
CVE-2025-67735: 22861
CVE-2025-55163: 22797
CVE-2025-58056: 22536
CVE-2025-58057: 22260

[Samk1710]

Reply from Tuxcare Team

Hello Sampurna,

Thank you for your time! Addressing your inquiries:
The old endpoint cve.tuxcare.com/els/download-json is indeed permanently discontinued in favor of the export at https://tuxcare.com/cve-tracker/api/cves/export/json. The full file is around 3 GB, regenerated twice a day; with filters, up to 10,000 rows.
Regarding PURLs: the export has no official mapping and carries no PURL or ecosystem fields. For that, the best source is our OSV feed, published on osv.dev under the TuxCare ecosystem. Every record there includes PURLs (for example pkg:rpm/tuxcare/httpd?distro=centos-6) and fixed versions, across rpm, deb, Maven, npm, PyPI and Packagist. The full set can be downloaded from https://osv-vulnerabilities.storage.googleapis.com/TuxCare/all.zip. Keep in mind it only contains released fixes, and a few products in the export, such as Amazon Linux 2 ELS and CloudLinux ELS, aren't in it yet.
On the record counts: the export mixes our ELS distro data with our open-source library monitoring data. In the second set, "product" is an upstream project (Babel, Angular, React) and "component" is one of its dependencies, which is where most of the 6,814 products and the 30,000 rows for CVE-2017-20162 come from. Those rows are distinct, so we'd suggest keying on CVE, product, component and version together rather than deduplicating on CVE alon.

Please let us know if that helps!
Best Regards,
Misael Ramirez | Senior Support Engineer | TuxCare Enterprise Support

Link to conversation
https://support.tuxcare.com/hc/requests/296039

[Samk1710]

@ziadhany I have updated the importer to use the OSV Data Source: https://osv-vulnerabilities.storage.googleapis.com/TuxCare/all.zip
Awaiting a follow up regarding the confirmation of the license from the Support Team.

python manage.py import tuxcare_importer_v2
Importing data using tuxcare_importer_v2
INFO 2026-10-22 09:47:23.518176 UTC Pipeline [TuxCareImporterPipeline] starting
INFO 2026-10-22 09:47:23.518356 UTC Step [fetch_zip] starting
INFO 2026-10-22 09:47:23.518440 UTC Fetching `https://osv-vulnerabilities.storage.googleapis.com/TuxCare/all.zip`
INFO 2026-10-22 09:47:27.134942 UTC Step [fetch_zip] completed in 4 seconds
INFO 2026-10-22 09:47:27.135528 UTC Step [collect_and_store_advisories] starting
INFO 2026-10-22 09:47:27.284310 UTC Collecting 17,688 advisories
INFO 2026-10-22 09:50:21.282477 UTC Progress: 10% (1769/17688) ETA: 1566 seconds (26.1 minutes)
INFO 2026-10-22 09:53:23.097456 UTC Progress: 20% (3538/17688) ETA: 1423 seconds (23.7 minutes)
INFO 2026-10-22 09:55:57.992284 UTC Progress: 30% (5307/17688) ETA: 1192 seconds (19.9 minutes)
INFO 2026-10-22 09:58:54.480809 UTC Progress: 40% (7076/17688) ETA: 1031 seconds (17.2 minutes)
INFO 2026-10-22 10:02:57.503693 UTC Progress: 50% (8844/17688) ETA: 930 seconds (15.5 minutes)
INFO 2026-10-22 10:05:37.188014 UTC Progress: 60% (10613/17688) ETA: 727 seconds (12.1 minutes)
INFO 2026-10-22 10:06:26.311517 UTC Progress: 70% (12382/17688) ETA: 488 seconds (8.1 minutes)
INFO 2026-10-22 10:07:17.769579 UTC Progress: 80% (14151/17688) ETA: 298 seconds (5.0 minutes)
INFO 2026-10-22 10:08:05.944168 UTC Progress: 90% (15920/17688) ETA: 138 seconds (2.3 minutes)
INFO 2026-10-22 10:09:13.021113 UTC Progress: 100% (17688/17688)
INFO 2026-10-22 10:09:13.051267 UTC Successfully collected 17,688 advisories
INFO 2026-10-22 10:09:13.051511 UTC Step [collect_and_store_advisories] completed in 1306 seconds (21.8 minutes)
INFO 2026-10-22 10:09:13.051590 UTC Pipeline completed in 1310 seconds (21.8 minutes)

[ziadhany]

LGTM, thanks @Samk1710

[Samk1710]

Update

Hello Sampurna,

There's still no license on the TuxCare OSV feed, and I'm sorry your question from 22 October has gone a week without a real answer. Support can't set licensing terms, so Alex Knol (introduced to you earlier in this ticket) took it to our legal team, and they have the request as of today.

The proposal would let projects like VulnerableCode import and redistribute the data. Legal hasn't signed off yet, though, so I can't give you the actual terms. The plan is to publish them in the cloudlinux/tuxcare-osv repository itself, which would give the importer a proper license_url to point at.

One request for PR 2104 in the meantime. The importer declares spdx_license_expression = "Apache-2.0" for our data. That's not a license we've granted, so please don't merge it with that value. A placeholder there is safer until we publish the terms.

I'll update this ticket as soon as legal decides, and by Tuesday 3 November either way.
Regards,

Ilia Druta | Senior Support Engineer | TuxCare Enterprise Support
Would you like to discuss how we're handling the ticket? Email my manager.
Support over Social Media activated! For quick questions, you can now DM us on Facebook or X.

Let's wait till we get the proper license and url. Will merge once we have them.

[Samk1710]

Update:

Hello Sampurna,

Sorry this is a day later than I promised. Our legal team has approved a licence. TuxCare's contributions to the advisory data are licensed under the Creative Commons Attribution 4.0 International License (CC-BY-4.0), with TuxCare, Inc. as the licensor. It covers the OSV feed (the cloudlinux/tuxcare-osv repository and the TuxCare records on OSV.dev, all.zip included) and the public CVE Tracker export. It takes effect when we publish the licence notice, and from then on it applies to every record published before it, copies you already have included, as well as to new ones.

Besides the standard CC BY 4.0 terms, there are three points specific to our data.

Credit "TuxCare (https://tuxcare.com)" and link to the relevant record or dataset where that's reasonably practicable, along with CC BY 4.0's own notice, license link and modification-marking requirements.
Third-party content isn't part of our grant. Copied CVE record content stays under the CVE Program Terms of Use, MITRE's copyright and licence notices included, and NVD/NIST and other upstream material stays under its own terms. Those notices have to travel with any redistribution of that material.
The licence covers advisory data only. It doesn't license TuxCare software or packages, give access to our services or package repositories, or grant patent or trademark rights.

So for PR 2104, the value to use is spdx_license_expression = "CC-BY-4.0".

Please let me know if you have additional questions.
Regards,

Ilia Druta | Senior Support Engineer | TuxCare Enterprise Support
Would you like to discuss how we're handling the ticket? Email my manager.
Support over Social Media activated! For quick questions, you can now DM us on Facebook or X.

[Samk1710]

LGTM, thanks @Samk1710

@ziadhany We are ready to merge this PR.