# GLOSI Attributes

### Package Attestation

| **Attribute**                      | **Description**                                                           | **Value**                                                                                                                                                   |
| ---------------------------------- | ------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Name                               | The name of the software package.                                         | Identify the package in the dashboard and link to vulnerability information.                                                                                |
| Version                            | The version of the software package.                                      | Track different versions and their corresponding vulnerabilities.                                                                                           |
| Description                        | A brief description of the package.                                       | Provide context and understand the package's purpose.                                                                                                       |
| Package Manager                    | The package manager used (e.g., npm, pip, Maven).                         | Categorize packages and tailor vulnerability analysis based on the package manager's ecosystem.                                                             |
| Package Download Location          | The URL or repository from which the package was downloaded.              | Understand the package source and potential supply chain risks.                                                                                             |
| PURL (Package URL)                 | A standardized way to identify a package.                                 | Unambiguous package identification and linking to vulnerability databases.                                                                                  |
| CPES (Common Platform Enumeration) | Standardized identifiers for platforms.                                   | Identify the platform the package is designed for and assess platform-specific vulnerabilities.                                                             |
| Checksum                           | A cryptographic hash of the package.                                      | Verify package integrity.                                                                                                                                   |
| Supplier                           | The organization or individual who supplied the package.                  | Identify the package source and assess supplier risk.                                                                                                       |
| License                            | The license under which the package is distributed.                       | Ensure license compliance and manage legal risks.                                                                                                           |
| Classification                     | Categorization of the package (e.g., OSS, Third Party, Private, Unknown). | Filter and group packages for analysis.                                                                                                                     |
| Package Published Timestamp        | The date and time the package was published.                              | Track package age and identify outdated packages.                                                                                                           |
| Last Scanned Timestamp             | The date and time the package was scanned.                                | "Last Scanned Timestamp" in the New Relic dashboard provides transparency to users, allowing them to understand the freshness of the  data they are seeing. |

### Source Attestation

<table><thead><tr><th width="199"></th><th width="200"></th><th width="274"></th></tr></thead><tbody><tr><td><strong>Attribute</strong></td><td><strong>Description</strong></td><td><strong>Value</strong> </td></tr><tr><td>Name</td><td>The name of the source code repository.</td><td>Identify the source code repository in the dashboard.</td></tr><tr><td>Repo Location</td><td>The URL of the source code repository.</td><td>Access the source code for further analysis.</td></tr><tr><td>Tag</td><td>The tag or branch of the source code.</td><td>Track different versions of the source code.</td></tr><tr><td>First Commit Time</td><td>The timestamp of the first commit for the tag</td><td>Understand the project's history.</td></tr><tr><td>Last Commit Time</td><td>The timestamp of the last commit for the tag</td><td>Assess the project's activity level and maintenance status.</td></tr><tr><td>Number of Commits/Authors</td><td>The number of commits and contributors to the repository.</td><td>Gauge the project's maturity and community involvement.</td></tr><tr><td>Timezones</td><td>The timezones of the contributors.</td><td>Information about the development team's geographical distribution.</td></tr><tr><td>Last Scanned Timestamp </td><td>The date and time the package was scanned.</td><td>"Last Scanned Timestamp" in the New Relic dashboard provides transparency to users, allowing them to understand the freshness of the  data they are seeing.</td></tr></tbody></table>

### Vulnerability Info

| **Attribute**                   | **Description**                                                                | **Value**                                                                                                                                                                                                        |
| ------------------------------- | ------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Vulnerability ID                | The unique identifier for the vulnerability.                                   | Link to vulnerability databases and detailed information about the CVE.                                                                                                                                          |
| Description                     | A description of the vulnerability.                                            | Understand the nature and impact of the vulnerability.                                                                                                                                                           |
| Severity                        | The severity level of the vulnerability (e.g., Critical, High, Medium, Low).   | Prioritize remediation efforts based on the severity level.                                                                                                                                                      |
| Base Score/CVSS Score           | A numerical score indicating the severity of the vulnerability.                | Quantify the risk and compare vulnerabilities.                                                                                                                                                                   |
| Namespace                       | The namespace of the vulnerability.                                            | Categorize vulnerabilities.                                                                                                                                                                                      |
| Data Source                     | The source of the vulnerability information.                                   | Understand the origin of the vulnerability data and assess its reliability.                                                                                                                                      |
| CVE State                       | The current state of the vulnerability in the codebase (e.g., fixed, unfixed). | Track remediation progress.                                                                                                                                                                                      |
| Fix State                       | The state of the fix (e.g., available, unavailable, work-around).              | Understand the availability of a solution.                                                                                                                                                                       |
| EPSS (Exploitability)           | Likelihood of a vulnerability being exploited.                                 | Prioritize vulnerabilities based on high exploitability. Visual highlighting on the dashboard.                                                                                                                   |
| EPSS (Percentile)               | Percentile ranking of the EPSS score.                                          | Provides context for exploitability. Enables creation of risk categories (high, medium, low).                                                                                                                    |
| Affected Package Version        | Specific package version vulnerable to a CVE.                                  | Accurate identification of vulnerable components. Precise filtering and avoidance of false positives.                                                                                                            |
| Fixed Package Version           | Package version containing the vulnerability fix.                              | Guide remediation efforts. Recommend specific upgrades. Track adoption of fixed versions.                                                                                                                        |
| Exploitable                     | Indicates whether the vulnerability is currently exploitable.                  | Prioritize remediation efforts.                                                                                                                                                                                  |
| Created date                    | Vulnerability created date                                                     | Understand the vulnerability's age and potential exposure window.                                                                                                                                                |
| Updated date                    | Vulnerability updated date                                                     | Track changes and updates to vulnerability information.                                                                                                                                                          |
| Withdrawn date                  | Vulnerability withdrawn date                                                   | Indicates that the vulnerability is no longer valid or relevant.                                                                                                                                                 |
| Origin                          | The source of the vulnerability scan result.                                   | Compare results from different scanners.                                                                                                                                                                         |
| KEV- product                    | Indicates the product that can be exploited                                    | Provides more precise information about the affected software or hardware. S                                                                                                                                     |
| KEV- Required Action            | Any mitigations to apply to minimize the exploitation                          | Provides actionable guidance for remediation.                                                                                                                                                                    |
| KEV - Known Ransomware Campaign | Known ransomware campaign                                                      | Highlights high-risk vulnerabilities that could be used for ransomware attacks. Enables                                                                                                                          |
| KEV - CWEs                      | CWEs used in this exploitability                                               | Provides a standardized way to categorize and understand the underlying weaknesses exploited by the vulnerability. New Relic can use this to track trends in CWE prevalence and identify common security issues. |

### Security Posture

| **Attribute**                                                                           | **Description**                                                                                                         | **Value**                                                                                                               |
| --------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
| <p><mark style="color:$info;">Type of security standard being evaluated.</mark><br></p> | <p><mark style="color:$info;">The type of the security check</mark> <br></p>                                            | <mark style="color:$info;">Identify the security standard being evaluated.</mark>                                       |
| Branch Protection                                                                       | Branch Protection:                                                                                                      | Branch Protection: Are the default and release branches protected with GitHub's branch protection settings?             |
| Pinned Dependencies                                                                     | Pinned Dependencies: Has the project declared and pinned its dependencies?                                              | Pinned Dependencies: Has the project declared and pinned its dependencies?                                              |
| Dangerous Workflow                                                                      | Dangerous Workflow: Does the project's GitHub Action workflows avoid dangerous patterns?                                | Dangerous Workflow: Does the project's GitHub Action workflows avoid dangerous patterns?                                |
| Static Application Security Testing (SAST)                                              | Static Application Security Testing (SAST): Does the project use static code analysis?                                  | Static Application Security Testing (SAST): Does the project use static code analysis?                                  |
| Dependency Update                                                                       | Dependency Update Tool: Does the project use a dependency update tool?                                                  | Dependency Update Tool: Does the project use a dependency update tool?                                                  |
| Security Policy:                                                                        | Security Policy: Has the project published a security policy?                                                           | Security Policy: Has the project published a security policy?                                                           |
| Fuzzing                                                                                 | Fuzzing: Does the project use fuzzing in OSS-Fuzz?                                                                      | Fuzzing: Does the project use fuzzing in OSS-Fuzz?                                                                      |
| Token Permissions                                                                       | Token Permissions: Is the project following the principle of least privilege?                                           | Token Permissions: Is the project following the principle of least privilege?                                           |
| Packaging                                                                               | Packaging: Has the project been published as a package that others can easily download, install, update, and uninstall? | Packaging: Has the project been published as a package that others can easily download, install, update, and uninstall? |
| Webhooks                                                                                | Webhooks: Are the webhooks defined in the repository token configured?                                                  | Webhooks: Are the webhooks defined in the repository token configured?                                                  |
| Score                                                                                   | The score for each security check.                                                                                      | Quantify the security posture.                                                                                          |
| Reason                                                                                  | The reason for the score.                                                                                               | Understand the factors contributing to the security posture.                                                            |
| Description                                                                             | A description of the security check.                                                                                    | Provide context and explain the purpose of the check.                                                                   |
| Issue Details                                                                           | Details about any security issues found.                                                                                | Understand the specific security vulnerabilities.                                                                       |

### Code Quality

<table><thead><tr><th width="199"></th><th width="200"></th><th width="274"></th></tr></thead><tbody><tr><td><strong>Attribute</strong></td><td><strong>Description</strong></td><td><strong>Value</strong></td></tr><tr><td>Binary Artifacts</td><td>Has the project generated executable (binary) artifacts in the source repository?</td><td>Binary Artifacts: Has the project generated executable (binary) artifacts in the source repository?</td></tr><tr><td>CII Best Practices</td><td>Does the project have a CII Best Practices badge?</td><td>CII Best Practices: Does the project have a CII Best Practices badge?</td></tr><tr><td>Fuzzing</td><td>Does the project use fuzzing in OSS-Fuzz?</td><td>Fuzzing: Does the project use fuzzing in OSS-Fuzz?</td></tr><tr><td>Pinned Dependencies</td><td>Has the project declared and pinned its dependencies?</td><td>Pinned Dependencies: Has the project declared and pinned its dependencies?</td></tr><tr><td>CI Tests</td><td>Does the project run tests before pull requests are merged?</td><td>CI Tests: Does the project run tests before pull requests are merged?</td></tr><tr><td>Code Review</td><td>: Does the project require a code review before pull/merge requests are assimilated?</td><td>Code Review: Does the project require a code review before pull/merge requests are assimilated?</td></tr><tr><td>Maintained</td><td>Is the project actively maintained?</td><td>Maintained: Is the project actively maintained?</td></tr><tr><td>Score</td><td>The score for the code quality check.</td><td>Quantify the code quality.</td></tr><tr><td>Reason</td><td>The reason for the score.</td><td>Understand the factors contributing to the code quality.</td></tr><tr><td>Description</td><td>A description of the code quality check.</td><td>Provide context and explain the purpose of the check.</td></tr><tr><td>Issue Details</td><td>Details about any code quality issues found.</td><td>Understand the specific code quality problems.</td></tr></tbody></table>

### Embedded Secrets

<table><thead><tr><th width="199"></th><th width="200"></th><th width="274"></th></tr></thead><tbody><tr><td><strong>Attribute</strong></td><td><strong>Description</strong></td><td><strong>Value</strong></td></tr><tr><td>Entropy</td><td>A measure of the randomness of the data.</td><td>Identify potential secrets based on their entropy.</td></tr><tr><td>Rule_ID</td><td>The ID of the rule that detected the secret.</td><td>Categorize secrets.</td></tr><tr><td>Match</td><td>The matched secret.</td><td>Display the detected secret.</td></tr><tr><td>Secret</td><td>The type of secret detected (e.g., API key, password).</td><td>Categorize secrets.</td></tr><tr><td>Fingerprint</td><td>A unique identifier for the secret.</td><td>Track secrets across different codebases.</td></tr></tbody></table>

### Mitre HipCheck

<table><thead><tr><th width="199"></th><th width="200"></th><th width="274"></th></tr></thead><tbody><tr><td><strong>Attribute</strong></td><td><strong>Description</strong></td><td><strong>Value</strong></td></tr><tr><td>Churn Analysis</td><td>Churn analysis attempts to identify the high prevalence of very large commits which may increase the risk of successful malicious contribution</td><td>Helps New Relic identify commits with a high risk of malicious code injection due to their size, allowing for focused review.</td></tr><tr><td>Entropy Analysis</td><td>Entropy analysis attempts to identify commits which contain a high degree of textual randomness which may indicate presence of packed malware</td><td>Flags potentially obfuscated or packed malware within commits based on high entropy, enabling New Relic to prioritize suspicious code for analysis.</td></tr><tr><td>Fuzz Analysis</td><td>This analysis checks if the repo is participating in the OSS Fuzz program</td><td>Shows if a project uses fuzz testing (OSS Fuzz), indicating a greater focus on security and potentially fewer undiscovered vulnerabilities.</td></tr><tr><td>Identity Analysis</td><td>Identity analysis looks at whether the author and committer identities for each commit are the same</td><td>Helps New Relic detect potentially malicious commits where the author and committer identities don't match, suggesting unauthorized modifications.</td></tr><tr><td>Review Analysis</td><td>Review analysis looks at whether pull requests receive at least one review prior to being merged</td><td>Indicates whether code reviews are practiced, a key security practice that reduces the likelihood of vulnerabilities slipping through.</td></tr><tr><td>Typo Analysis</td><td>Typo analysis attempts to identify possible typo squatting attacks</td><td>Helps New Relic detect potential typo squatting attacks, where malicious packages mimic legitimate ones, protecting users from supply chain attacks.</td></tr></tbody></table>

### Source Code Metrics

<table><thead><tr><th width="199"></th><th width="200"></th><th width="274"></th></tr></thead><tbody><tr><td><strong>Attribute</strong></td><td><strong>Description</strong></td><td><strong>Value</strong></td></tr><tr><td>Complexity</td><td>A measure of the code's complexity (e.g., cyclomatic complexity).</td><td>Assess the maintainability and testability of the code.</td></tr><tr><td>Language</td><td>The programming language used.</td><td>Filter and group code by language for analysis.</td></tr><tr><td>LOC (Lines of Code)</td><td>Total lines of code including comments and blank lines.</td><td>Measure the size of the codebase.</td></tr><tr><td>SLOC (Source Lines of Code)</td><td>Lines of code excluding comments and blank lines.</td><td>More accurate measure of code size.</td></tr></tbody></table>

### Dependency Decomposition

<table><thead><tr><th width="199"></th><th width="200"></th><th width="274"></th></tr></thead><tbody><tr><td><strong>Attribute</strong></td><td><strong>Description</strong></td><td><strong>Value</strong></td></tr><tr><td>Depth</td><td>The depth of the dependency tree.</td><td>Understand the complexity of the dependency graph.</td></tr><tr><td>Number of Direct Dependencies</td><td>The number of direct dependencies.</td><td>Manage direct dependencies and their associated risks.</td></tr><tr><td>Number of Transitive Dependencies</td><td>The number of transitive dependencies.</td><td>Understand the full extent of the dependency graph and potential vulnerabilities.</td></tr><tr><td>Dependency Graph</td><td>A visual representation of the dependency tree.</td><td>Analyze dependencies and their relationships.</td></tr></tbody></table>

### EOL

| **Attribute** | **Description**                         | **Value**                                                                |
| ------------- | --------------------------------------- | ------------------------------------------------------------------------ |
| EOL Timestamp | The end-of-life date for the component. | Identify components that are no longer supported and pose a higher risk. |

### Lineaje Reputation

<table><thead><tr><th width="199"></th><th width="200"></th><th width="274"></th></tr></thead><tbody><tr><td><strong>Attribute</strong></td><td><strong>Description</strong></td><td><strong>Value</strong></td></tr><tr><td>Risk Score</td><td>Lineaje Risk Score is a 0-10 score representing the overall risk of an open-source component, calculated using a weighted average of age, vulnerability score, code quality, and security posture.</td><td>New Relic can use risk score to quickly assess component risk: ZIRL (0) is ideal, while CIRL (9-10) indicates critical risk. This allows for prioritizing remediation efforts and visualizing risk across a project's dependencies.</td></tr><tr><td>Attestation Level </td><td>Measure of how much Lineaje trusts a given open-source component.</td><td>LCAL 0: Unknown Component: Lineaje cannot identify the component or verify its provenance. LCAL 1: Known Component: Lineaje can identify the component and its PURL but cannot verify its integrity. LCAL 2: Attested Component: Lineaje has verified the component's integrity and provenance. LCAL 3: Attested Build &#x26; Source: Lineaje has verified both the component's package and its source code, ensuring they match and are built from the declared source. LCAL 4: Fully Attested: Lineaje has performed extensive checks, including malware scanning, to ensure the component is untampered and free of malicious code.</td></tr></tbody></table>

### Geo Provenance

<table><thead><tr><th width="199"></th><th width="200"></th><th width="274"></th></tr></thead><tbody><tr><td><strong>Attribute</strong></td><td><strong>Description</strong></td><td><strong>Value</strong></td></tr><tr><td>Country Code</td><td>The country code where the code was committed.</td><td>Display on a map or allow filtering by country.</td></tr><tr><td>Time zone</td><td>The time zone where the code was committed.</td><td>Correlate with contributor locations.</td></tr><tr><td>Contributor Name</td><td>Full name of the contributor.</td><td>Identify key contributors.</td></tr><tr><td>Contributor Email</td><td>Email address of the contributor.</td><td>Contact information for contributors.</td></tr><tr><td>Contributor User ID</td><td>Unique identifier for the contributor.</td><td>Track contributions across projects.</td></tr><tr><td>Contributor Location</td><td>Location of the contributor.</td><td>Visualize contributor distribution on a map.</td></tr><tr><td>Number of Commits (per contributor)</td><td>Number of commits by each contributor.</td><td>Identify top contributors.</td></tr><tr><td>First Commit (per contributor)</td><td>Timestamp of the first commit by each contributor.</td><td>Track contributor involvement over time.</td></tr><tr><td>Last Commit (per contributor)</td><td>Timestamp of the last commit by each contributor.</td><td>Assess recent activity.</td></tr></tbody></table>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.veedna.com/gold-open-source-gos/gold-catalog/container-images/glosi-global-lineaje-open-source-intelligence/glosi-attributes.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.