package manager: `torb audit` advisory database

orion commented

2026-10-12 06:59:39 +00:00

Collaborator

Context

torb audit (#23) reports yanked and deprecated versions of the locked graph, which the registry index already carries. RELEASE.md section 7.6 also describes a public advisory database (one TorbScript file per advisory, OSV export) that torb audit is to check the lock against (CONCEPT: "torb audit checks the locked graph against the advisory database of the registry"). That database does not exist yet.

Source

docs/design/RELEASE.md section 7.6, "The advisory database"
CONCEPT.md, package manager list

Acceptance criteria

The advisory file format (receiver-script vocabulary, affected version ranges, severity, summary) is specified in RELEASE.md 7.6 and has a static reader in compiler/src/package/
torb audit additionally reports every locked version an advisory covers, with the advisory id and summary, and exits non-zero
Documented in docs/tooling/torb-audit.md

Dependencies

#23 (torb audit for yanked and deprecated versions)
A published advisory repository / registry endpoint to read from. Creating it is a public commitment and an external service, so this issue needs an owner decision before it is ready.

## Context `torb audit` (#23) reports yanked and deprecated versions of the locked graph, which the registry index already carries. RELEASE.md section 7.6 also describes a public **advisory database** (one TorbScript file per advisory, OSV export) that `torb audit` is to check the lock against (CONCEPT: "`torb audit` checks the locked graph against the advisory database of the registry"). That database does not exist yet. ## Source - docs/design/RELEASE.md section 7.6, "The advisory database" - CONCEPT.md, package manager list ## Acceptance criteria - [ ] The advisory file format (receiver-script vocabulary, affected version ranges, severity, summary) is specified in RELEASE.md 7.6 and has a static reader in `compiler/src/package/` - [ ] `torb audit` additionally reports every locked version an advisory covers, with the advisory id and summary, and exits non-zero - [ ] Documented in `docs/tooling/torb-audit.md` ## Dependencies - #23 (`torb audit` for yanked and deprecated versions) - A published advisory repository / registry endpoint to read from. Creating it is a public commitment and an external service, so this issue needs an owner decision before it is ready.

orion added the

loop

label

2026-10-12 06:59:39 +00:00

orion referenced this issue

2026-10-12 06:59:52 +00:00

package manager: torb audit #23

orion referenced this issue

2026-10-12 06:59:53 +00:00

package manager: torb audit #23

orion referenced this issue

2026-10-12 06:59:53 +00:00

package manager: torb audit #23

orion referenced this issue

2026-10-12 07:08:21 +00:00

feat(cli): add torb audit #319

orion commented

2026-10-23 23:53:17 +00:00

Author

Collaborator

[loop:torbscript] claim refine by session:loop-torbscript-20261024 until 2026-10-24T03:50Z

orion referenced this issue

2026-10-23 23:55:18 +00:00

package manager: advisory files and torb audit --advisories <directory> (step 1 of #309) #451

orion commented

2026-10-23 23:55:26 +00:00

Author

Collaborator

[loop:torbscript] intake: in scope (author orion, label loop). No duplicate: #23 is closed and split this part off; no other open issue covers advisories. No collision with a design record: RELEASE.md 7.6 announces the database but leaves the file format open. The only owner-reserved part is publishing the public advisory repository and the endpoint that serves it (public commitment, external service); that is not needed for a first step.

orion commented

2026-10-23 23:55:26 +00:00

Author

Collaborator

[loop:torbscript] decided by the loop: this issue is an epic, too big for one PR. The format, the reader and a local-directory check need no public commitment, so they go first as #451 (ready). Steps, each filed just in time when the previous one landed:

1. Advisory file format in RELEASE.md 7.6, static reader, torb audit --advisories <directory> - #451
2. OSV export of a directory of advisories (a tool, tested against the OSV schema)
3. Owner decision first: create and publish the public advisory repository and the endpoint/mirror path that serves it (public commitment, external service); then torb audit fetches it by default (mirrors, cache, --offline, signing like the index in 7.14 if served by a registry)
Why this split: steps 1 and 2 are internal technical design (format follows the index and lock conventions: receiver script of literals, read statically) and testable with a fixture directory; only step 3 is a public commitment. Details of the format are in #451.

[loop:torbscript] decided by the loop: this issue is an epic, too big for one PR. The format, the reader and a local-directory check need no public commitment, so they go first as #451 (ready). Steps, each filed just in time when the previous one landed: - [ ] 1. Advisory file format in RELEASE.md 7.6, static reader, `torb audit --advisories <directory>` - #451 - [ ] 2. OSV export of a directory of advisories (a tool, tested against the OSV schema) - [ ] 3. **Owner decision first**: create and publish the public advisory repository and the endpoint/mirror path that serves it (public commitment, external service); then `torb audit` fetches it by default (mirrors, cache, `--offline`, signing like the index in 7.14 if served by a registry) Why this split: steps 1 and 2 are internal technical design (format follows the index and lock conventions: receiver script of literals, read statically) and testable with a fixture directory; only step 3 is a public commitment. Details of the format are in #451.

orion commented

2026-10-23 23:55:26 +00:00

Author

Collaborator

[loop:torbscript] refine: epic split, first step filed as #451 (labelled ready), claim released, next: waiting (epic; steps 2 and 3 are filed after #451 lands, step 3 needs an owner decision). Worker usage: RE sonnet/medium, about 60k tokens (estimate).

orion referenced this issue

2026-10-24 00:13:39 +00:00

feat(package): read advisory files and check the lock against them #452

Rows
Columns

package manager: torb audit advisory database #309

Context

Source

Acceptance criteria

Dependencies

package manager: `torb audit` advisory database #309