Add bottlerocket advisories

[pombredanne]

AWS uses Bottlerocket, a Linux distro for containers

• https://bottlerocket.dev/
• https://aws.amazon.com/bottlerocket/
• https://github.com/bottlerocket-os

Based on:

• https://github.com/bottlerocket-os/bottlerocket-project-website/blob/8ed231c2e98619c22db2bbd85d01b558df18eb26/content/en/os/1.34.x/concepts/variants/index.markdown#security-advisories
• https://bottlerocket.dev/en/os/1.34.x/concepts/variants/#software-inventory-and-security-advisories

Security Advisories
Bottlerocket publishes security advisories on the repo’s GitHub’s Security tab and a gzipped updateinfo.xml file at advisories.bottlerocket.aws (make sure you follow redirects: e.g. use curl -LO https://advisories.bottlerocket.aws/updateinfo.xml.gz).

See also this discussion thread by @ginglis13 :

• Changes to Bottlerocket's security advisory publication bottlerocket-os/bottlerocket#4063

Therefore, sources are:

• https://github.com/bottlerocket-os/bottlerocket/security
• https://advisories.bottlerocket.aws/updateinfo.xml.gz

The purl for this distro is unclear in particular:

• https://bottlerocket.dev/en/os/1.34.x/concepts/variants/#software-inventory-and-security-advisories

Software inventory and security advisories

Since Bottlerocket doesn’t use a package manager, keeping track of the software delivered as part of a variant is a little different. Additionally, the concept of a ‘package’ is only relevant as a part of the build process. In the course of running Bottlerocket, you probably want to keep track of what specific software and versions you are using as well as understand how this software relates to known vulnerabilities.
Note

The best patching strategy for Bottlerocket is to always update to the most recent release. Since packages are only used at build-time and the packages cannot mutate, the inventory will never change for a given version and variant. Updating to the most recent version will patch all packages.

Bottlerocket provides information to both understand the software included in a variant and how it connects to published security advisories.

The packages are likely sourced from updates.bottlerocket.aws ... details are TBD

[kunalsz]

@pombredanne I would like to work on this issue

[pombredanne]

@kunalsz see also the details I have added to the description for reference