extractor/os/rpm: add AlmaLinux ecosystem mapping - #2148

Closes #2091

Problem

ecosystem.go maps RPM packages to OSV ecosystems based on ID from /etc/os-release. It already handles rhel, rocky, and openEuler, but almalinux has no case. Any RPM package extracted from an AlmaLinux container falls through with an empty namespace and never matches anything on OSV.dev.

On docker.io/library/almalinux:9:

pkg:rpm//[email protected]_1.2   ← namespace empty, zero ALSA matches

OSV.dev tracks 1,000+ advisories under the AlmaLinux ecosystem — all prefixed ALSA-. None of them are reachable today because the ecosystem is never set. A few examples that should have been caught:

• ALSA-2022:8299 — curl 7.76.1 — Critical (CVE-2022-32221)
• ALSA-2023:0333 — curl 7.76.1 — High (CVE-2022-43552 use-after-free)
• ALSA-2023:1701 — openssl 3.0.7 — Important (CVE-2023-0286, CVSS 7.4)
• ALSA-2023:2650 — python3 3.9.16 — Critical (CVE-2023-24329)
• ALSA-2024:2988 — kernel — Important (multiple privilege escalation CVEs)

AlmaLinux is the main CentOS 8 replacement after Red Hat ended free access in December 2021. The official almalinux Docker image has over 1B pulls on Docker Hub.

Solution

The os/rpm extractor already reads ID from /etc/os-release and stores it in rpmmeta.Metadata.OSID. The EcosystemAlmaLinux constant is already defined in osvconstants — it's just not wired up. The fix is one if-branch in ecosystem.go, same pattern as the rocky case directly above it:

if m.OSID == "almalinux" {
    return osvecosystem.Parsed{Ecosystem: osvconstants.EcosystemAlmaLinux, Suffix: m.OSVersionID}
}

No new extractor, no new dependencies.

Before / After

Before:

pkg:rpm//[email protected]_1.2

After:

pkg:rpm/almalinux/[email protected]_1.2   (ecosystem: AlmaLinux:9)

With the namespace correctly set, the OSV matcher can now find ALSA-2022:8299 and the rest.

Files changed

• extractor/filesystem/os/ecosystem/ecosystem.go — one if-branch, 3 lines
• extractor/filesystem/os/ecosystem/ecosystem_test.go — 3 new test cases (AlmaLinux_9, AlmaLinux_8, AlmaLinux_no_version)
• docs/supported_inventory_types.md — AlmaLinux added to the RPM row

Testing

go test ./extractor/filesystem/os/ecosystem/... -v -run TestEcosystemRPM
--- PASS: TestEcosystemRPM/AlmaLinux_9 (0.00s)
--- PASS: TestEcosystemRPM/AlmaLinux_8 (0.00s)
--- PASS: TestEcosystemRPM/AlmaLinux_no_version (0.00s)
PASS
ok  	github.com/google/osv-scalibr/extractor/filesystem/os/ecosystem	0.007s

go test ./extractor/filesystem/os/ecosystem/...
PASS   (all 13 existing cases still pass)

go test ./extractor/filesystem/os/rpm/...
PASS

go vet ./extractor/filesystem/os/ecosystem/...
(no output)