@renovatebot/osv-offline-db 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2021 Jamie Magee <jamie.magee@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,19 @@
+# osv-offline-db
+
+[![Package version](https://img.shields.io/npm/v/@renovatebot/osv-offline-db?style=for-the-badge)](https://www.npmjs.com/package/@renovatebot/osv-offline-db)
+[![Build status](https://img.shields.io/github/workflow/status/jamiemagee/osv-offline/Build?style=for-the-badge)](https://github.com/jamiemagee/osv-offline/actions/workflows/build.yml)
+[![MIT license](https://img.shields.io/badge/license-MIT-blue?style=for-the-badge)](./LICENSE)
+![Stability experimental](https://img.shields.io/badge/stability-experimental-orange.svg?style=for-the-badge)
+
+## License
+
+This package is licensed under [the MIT license](https://opensource.org/licenses/MIT).
+
+Vulnerabilities are provided from the following upstream data sources and licenses:
+
+- [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md))
+- [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE))
+- [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license))
+- [Rust Advisory Database](https://github.com/RustSec/advisory-db) ([CC0 1.0](https://github.com/rustsec/advisory-db/blob/main/LICENSE.txt))
+- [Global Security Database](https://github.com/cloudsecurityalliance/gsd-database) ([CC0 1.0](https://github.com/cloudsecurityalliance/gsd-database/blob/main/LICENSE))
+- [OSS-Fuzz](https://github.com/google/oss-fuzz-vulns) ([CC-BY 4.0](https://github.com/google/oss-fuzz-vulns/blob/main/LICENSE))

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { OsvOfflineDb } from './lib/db';
+export { Ecosystem, ecosystems } from './lib/ecosystem';
+export * as Osv from './lib/osv';

package/dist/index.js

@@ -0,0 +1,31 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Osv = exports.ecosystems = exports.OsvOfflineDb = void 0;
+var db_1 = require("./lib/db");
+Object.defineProperty(exports, "OsvOfflineDb", { enumerable: true, get: function () { return db_1.OsvOfflineDb; } });
+var ecosystem_1 = require("./lib/ecosystem");
+Object.defineProperty(exports, "ecosystems", { enumerable: true, get: function () { return ecosystem_1.ecosystems; } });
+exports.Osv = __importStar(require("./lib/osv"));

package/dist/lib/db.d.ts

@@ -0,0 +1,10 @@
+import { Ecosystem } from './ecosystem';
+import { Osv } from '..';
+export declare class OsvOfflineDb {
+    static readonly rootDirectory: string;
+    private db;
+    private constructor();
+    private initialize;
+    static create(): Promise<OsvOfflineDb>;
+    query(ecosystem: Ecosystem, packageName: string): Promise<Osv.Vulnerability[]>;
+}

package/dist/lib/db.js

@@ -0,0 +1,44 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OsvOfflineDb = void 0;
+const os_1 = require("os");
+const path_1 = __importDefault(require("path"));
+const nedb_1 = __importDefault(require("@seald-io/nedb"));
+const ecosystem_1 = require("./ecosystem");
+class OsvOfflineDb {
+    // eslint-disable-next-line @typescript-eslint/no-empty-function
+    constructor() {
+        this.db = {};
+    }
+    async initialize() {
+        for (const ecosystem of ecosystem_1.ecosystems) {
+            this.db[ecosystem] = new nedb_1.default({
+                filename: path_1.default.join(OsvOfflineDb.rootDirectory, `${ecosystem.toLowerCase()}.nedb`),
+            });
+            await this.db[ecosystem].loadDatabaseAsync();
+        }
+    }
+    static async create() {
+        const osvOfflineDb = new OsvOfflineDb();
+        await osvOfflineDb.initialize();
+        return osvOfflineDb;
+    }
+    async query(ecosystem, packageName) {
+        return await this.db[ecosystem].findAsync({
+            affected: {
+                $elemMatch: {
+                    package: {
+                        name: packageName,
+                        ecosystem,
+                        purl: `pkg:${ecosystem.toLowerCase()}/${packageName}`,
+                    },
+                },
+            },
+        });
+    }
+}
+exports.OsvOfflineDb = OsvOfflineDb;
+OsvOfflineDb.rootDirectory = path_1.default.join((0, os_1.tmpdir)(), 'osv-offline');

package/dist/lib/ecosystem.d.ts

@@ -0,0 +1,5 @@
+/**
+ * https://github.com/google/osv/blob/b9f0d1c1b377b0ab5804808f24032be965a571b8/lib/osv/ecosystems.py#L313-L321
+ */
+export declare const ecosystems: readonly ["crates.io", "Go", "Maven", "npm", "NuGet", "PyPI", "RubyGems"];
+export declare type Ecosystem = typeof ecosystems[number];

package/dist/lib/ecosystem.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ecosystems = void 0;
+/**
+ * https://github.com/google/osv/blob/b9f0d1c1b377b0ab5804808f24032be965a571b8/lib/osv/ecosystems.py#L313-L321
+ */
+exports.ecosystems = [
+    'crates.io',
+    'Go',
+    'Maven',
+    'npm',
+    'NuGet',
+    'PyPI',
+    'RubyGems',
+];

package/dist/lib/osv.d.ts

@@ -0,0 +1,62 @@
+/**
+ * A schema for describing a vulnerability in an open source package.
+ */
+export interface Vulnerability {
+    affected?: Affected[];
+    aliases?: string[];
+    credits?: Credit[];
+    databaseSpecific?: {
+        [key: string]: unknown;
+    };
+    details?: string;
+    id: string;
+    modified: Date;
+    published?: Date;
+    references?: Reference[];
+    related?: string[];
+    schemaVersion?: string;
+    severity?: Severity[];
+    summary?: string;
+    withdrawn?: Date;
+}
+export interface Affected {
+    databaseSpecific?: {
+        [key: string]: unknown;
+    };
+    ecosystemSpecific?: {
+        [key: string]: unknown;
+    };
+    package?: Package;
+    ranges?: Range[];
+    versions?: string[];
+}
+export interface Package {
+    ecosystem: string;
+    name: string;
+    purl?: string;
+}
+export interface Range {
+    events: Event[];
+    repo?: string;
+    type: RangeType;
+}
+export interface Event {
+    introduced?: string;
+    fixed?: string;
+    limit?: string;
+}
+export declare type RangeType = 'ECOSYSTEM' | 'GIT' | 'SEMVER';
+export interface Credit {
+    contact?: string[];
+    name: string;
+}
+export interface Reference {
+    type: ReferenceType;
+    url: string;
+}
+export declare type ReferenceType = 'ADVISORY' | 'ARTICLE' | 'FIX' | 'GIT' | 'PACKAGE' | 'REPORT' | 'WEB';
+export interface Severity {
+    score: string;
+    type: SeverityType;
+}
+export declare type SeverityType = 'CVSS_V3';

package/dist/lib/osv.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/package.json

@@ -0,0 +1,20 @@
+{
+  "name": "@renovatebot/osv-offline-db",
+  "version": "1.0.0",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@seald-io/nedb": "3.0.0"
+  },
+  "devDependencies": {
+    "@tsconfig/node14": "1.0.3",
+    "@types/node": "16.11.52",
+    "prettier": "2.7.1",
+    "ts-node": "10.9.1",
+    "typescript": "4.7.4"
+  }
+}