Docs
Data sources
What the daily snapshot contains, under which terms, and how cra checks it.
Once a day our server builds a snapshot of public advisories and publishes it at https://data.shipward.dev/v1/.
It receives nothing from you: the files are the same for everyone.
Sources #
We pass on only sources whose terms allow it, filtered to package ecosystems and shortened. Each is named here, in
the snapshot’s index and in every cra scan.
| Source | Licence |
|---|---|
| GitHub Advisory Database | CC-BY-4.0 |
| Go Vulnerability Database | CC-BY-4.0 |
| PyPA Advisory Database | CC-BY-4.0 |
| RustSec Advisory Database | CC0-1.0 (parts from GitHub: CC-BY-4.0) |
| Drupal Security Advisories | MIT |
| OSS-Fuzz | CC-BY-4.0 |
| CISA Known Exploited Vulnerabilities Catalog | CC0-1.0 |
The advisories come from OSV.dev’s collection. Records from sources whose terms do not allow commercial reuse are left out, and so are records of malicious packages.
cra fetches two feeds from their publishers itself, and they are not in the snapshot: the
ENISA EU Vulnerability Database and
EPSS scores by FIRST.org, generated by Empirical Security.
The snapshot #
| File | What |
|---|---|
v1/index.json | The index: each file’s SHA-256 and size, the sources and their licences, the time it was made, and an Ed25519 signature over all of it |
v1/<run>/osv-<ecosystem>.json.gz | The advisories of one ecosystem (npm, NuGet, Packagist, Go, PyPI, Maven, crates.io, RubyGems) |
v1/<run>/exploited.json.gz | CISA’s catalog of known exploited vulnerabilities |
Each run writes a new folder and replaces the index last, so a reader never sees an index that names missing files.
cra accepts an index only with a valid signature from a key built into it, then checks each file’s SHA-256 against
the index. The public key:
lEo2EB4n5NrYCg2b0HUxtz/GYEvW05AW9OOfrfncpYg=