extractor/os/rpm: add AlmaLinux ecosystem mapping

[herdiyana256]

Closes #2091

Problem

ecosystem.go maps RPM packages to OSV ecosystems based on ID from /etc/os-release. It already handles rhel, rocky, and openEuler, but almalinux has no case. Any RPM package extracted from an AlmaLinux container falls through with an empty namespace and never matches anything on OSV.dev.

On docker.io/library/almalinux:9:

pkg:rpm//curl@7.76.1-14.el9_1.2   ← namespace empty, zero ALSA matches

OSV.dev tracks 1,000+ advisories under the AlmaLinux ecosystem — all prefixed ALSA-. None of them are reachable today because the ecosystem is never set. A few examples that should have been caught:

• ALSA-2022:8299 — curl 7.76.1 — Critical (CVE-2022-32221)
• ALSA-2023:0333 — curl 7.76.1 — High (CVE-2022-43552 use-after-free)
• ALSA-2023:1701 — openssl 3.0.7 — Important (CVE-2023-0286, CVSS 7.4)
• ALSA-2023:2650 — python3 3.9.16 — Critical (CVE-2023-24329)
• ALSA-2024:2988 — kernel — Important (multiple privilege escalation CVEs)

AlmaLinux is the main CentOS 8 replacement after Red Hat ended free access in December 2021. The official almalinux Docker image has over 1B pulls on Docker Hub.

Solution

The os/rpm extractor already reads ID from /etc/os-release and stores it in rpmmeta.Metadata.OSID. The EcosystemAlmaLinux constant is already defined in osvconstants — it's just not wired up. The fix is one if-branch in ecosystem.go, same pattern as the rocky case directly above it:

if m.OSID == "almalinux" {
    return osvecosystem.Parsed{Ecosystem: osvconstants.EcosystemAlmaLinux, Suffix: m.OSVersionID}
}

No new extractor, no new dependencies.

Before / After

Before:

pkg:rpm//curl@7.76.1-14.el9_1.2

After:

pkg:rpm/almalinux/curl@7.76.1-14.el9_1.2   (ecosystem: AlmaLinux:9)

With the namespace correctly set, the OSV matcher can now find ALSA-2022:8299 and the rest.

Files changed

• extractor/filesystem/os/ecosystem/ecosystem.go — one if-branch, 3 lines
• extractor/filesystem/os/ecosystem/ecosystem_test.go — 3 new test cases (AlmaLinux_9, AlmaLinux_8, AlmaLinux_no_version)
• docs/supported_inventory_types.md — AlmaLinux added to the RPM row

Testing

go test ./extractor/filesystem/os/ecosystem/... -v -run TestEcosystemRPM
--- PASS: TestEcosystemRPM/AlmaLinux_9 (0.00s)
--- PASS: TestEcosystemRPM/AlmaLinux_8 (0.00s)
--- PASS: TestEcosystemRPM/AlmaLinux_no_version (0.00s)
PASS
ok  	github.com/google/osv-scalibr/extractor/filesystem/os/ecosystem	0.007s

go test ./extractor/filesystem/os/ecosystem/...
PASS   (all 13 existing cases still pass)

go test ./extractor/filesystem/os/rpm/...
PASS

go vet ./extractor/filesystem/os/ecosystem/...
(no output)

[herdiyana256]

Hi @michaelkedar,

PR is ready for review. All 14 CI checks passing.

Thanks!

[michaelkedar]

Looks good!

[michaelkedar]

Thanks for this @herdiyana256!
Could you also add some end-to-end tests in osv-scanner for this as well.

[herdiyana256]

Hi @michaelkedar, sure! I'll submit a follow-up PR to google/osv-scanner for the AlmaLinux E2E tests. Will link it here once submitted. Thanks!

[herdiyana256]

Follow-up PR submitted to google/osv-scanner as requested: google/osv-scanner#2870

[herdiyana256]

Closing this PR as the changes have been merged upstream via copybara (commit a940948). Thank you @michaelkedar for the review!