Container Registry and Software Supply Chain Platform  ·  View 18 of 33  ·  4 · Runtime

Advisory Ingest and Reconciliation

Two feeds, one advisory record, and what happens when the two disagree.

Editable source SVG draw.io All views
Fetch Normalise Reconcile Decide Publish Feed A · OSV OSV Mirror 15 min poll purl + version range Advisory record A Feed B · distro + NVD Distro and NVD Mirror hourly CPE → purl map Advisory record B Reconciler Merge by identifier CVE · GHSA Feeds agree? Advisory Store one record per id Disagreement Severity conflict not acted on Flagged for review Staleness Feed age metric Age over 6 h? Policy input + alert Advisory Ingest and Two-Feed Reconciliation External / third party Application we own Data store Decision point Risk / gap Security / platform One failing feed does not stall evaluation. A severity in one feed and absent from the other is flagged, never applied. v 1.0 · owner Security Architecture · date 2026-09

Decisions

  • At least two independent feeds, reconciled into a single record keyed by identifier
  • A severity present in one feed and absent from the other is flagged for review, never acted on automatically
  • A single feed failing does not stall evaluation while the other is healthy

Staleness as a policy input

  • Feed age is exposed to policy; a bundle may deny on feed staleness rather than pretending the feed is current
  • Ingestion lag is a first-class metric with an alert at 6 hours
  • Advisory records are amended, never replaced — the amendment history is what drives re-evaluation

Threat model

  • A poisoned feed is an assumed condition, not an edge case; reconciliation is the mitigation
  • Both mirrors are pulled into the estate rather than queried live, so an upstream outage does not become an admission outage
◀  Admission Decision All views Advisory-Driven Re-Evaluation  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 33 views · open-source, on-premises18-advisory-reconciliation