Skip to main content

Read vulnerabilities from your own OSV

A vulnerability check of Compass (for example CVE-2021-23337) reads the vulnerability from OSV. Out of the box, Astrolabe reads the public service, https://api.osv.dev: you have nothing to do. Add the OSV connection only if your company runs its own copy of OSV, for example because Astrolabe cannot reach the Internet. There is no token to enter.

Before you start​

The Tech stack plugin is on: see Turn on a plugin. You know the address of your copy of OSV, for example https://osv.acme.example.

🔌 Add the connection​

  1. In the left sidebar, at the bottom, click Administration.

  2. Under PLATFORM, click Company connections.

  3. On the OSV card, marked Not configured, click Configure.

  4. At the top, click Add connection.

  5. In the form, leave Name as OSV. In OSV address, replace https://api.osv.dev with the address of your copy, for example https://osv.acme.example.

  6. Click Test connection. The form says Connection works: the source accepted the credentials.

  7. Click Add. Astrolabe restarts on its own: wait between 30 seconds and a minute.

The list shows OSV, with the host of your copy, the source Administration and the state Connected.

👀 When OSV stops answering​

Astrolabe checks OSV again every few minutes, whether you added the connection or kept the public service. When it does not answer, Administration › Problems shows a line OSV with the host and the cause, for example osv.acme.example refuses the connection. Check the port, and that the service runs. Click Fix it: it opens the OSV connection.

❓ Questions​

Do I need this connection for vulnerability checks to work? No. Without it, Astrolabe reads https://api.osv.dev. Add it only for a copy inside your network.

What happens to a check while OSV does not answer? The check says Not measured: it counts neither for nor against the component. It is measured again at the next calculation once OSV answers.

🛠 Troubleshooting​

What you seeWhat to do
After Test connection: the host you typed followed by refused the connection. Check the port, and that the service runs.Check the port in OSV address, and ask the team that runs your copy of OSV whether it is up.
After Test connection: No server answers to the name followed by the host you typedCheck the spelling of OSV address against the address you open in your browser. If it is right, Astrolabe cannot see that server: tell the administrator of your network.
A line OSV with the host api.osv.dev in Administration › ProblemsAstrolabe cannot reach the public OSV. Ask the administrator of your network to open https://api.osv.dev, or add the connection to your own copy with the steps above.

✅ That's it!

Next: Check a vulnerability in a campaign.