Add bottlerocket advisories #1828
Description
AWS uses Bottlerocket, a Linux distro for containers
- https://bottlerocket.dev/
- https://aws.amazon.com/bottlerocket/
- https://github.com/bottlerocket-os
Based on:
- https://github.com/bottlerocket-os/bottlerocket-project-website/blob/8ed231c2e98619c22db2bbd85d01b558df18eb26/content/en/os/1.34.x/concepts/variants/index.markdown#security-advisories
- https://bottlerocket.dev/en/os/1.34.x/concepts/variants/#software-inventory-and-security-advisories
Security Advisories
Bottlerocket publishes security advisories on the repo’s GitHub’s Security tab and a gzipped updateinfo.xml file at advisories.bottlerocket.aws (make sure you follow redirects: e.g. use curl -LO https://advisories.bottlerocket.aws/updateinfo.xml.gz).
See also this discussion thread by @ginglis13 :
Therefore, sources are:
- https://github.com/bottlerocket-os/bottlerocket/security
- https://advisories.bottlerocket.aws/updateinfo.xml.gz
The purl for this distro is unclear in particular:
Software inventory and security advisories
Since Bottlerocket doesn’t use a package manager, keeping track of the software delivered as part of a variant is a little different. Additionally, the concept of a ‘package’ is only relevant as a part of the build process. In the course of running Bottlerocket, you probably want to keep track of what specific software and versions you are using as well as understand how this software relates to known vulnerabilities.
Note
The best patching strategy for Bottlerocket is to always update to the most recent release. Since packages are only used at build-time and the packages cannot mutate, the inventory will never change for a given version and variant. Updating to the most recent version will patch all packages.
Bottlerocket provides information to both understand the software included in a variant and how it connects to published security advisories.
The packages are likely sourced from updates.bottlerocket.aws ... details are TBD