@renovatebot/osv-offline-db 1.0.0-next.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2021 Jamie Magee <jamie.magee@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,18 @@
+# osv-offline-db
+
+[![Package version](https://img.shields.io/npm/v/@renovatebot/osv-offline-db?style=for-the-badge)](https://www.npmjs.com/package/@renovatebot/osv-offline-db)
+[![Build status](https://img.shields.io/github/actions/workflow/status/renovatebot/osv-offline/build.yml?branch=main&style=for-the-badge)](https://github.com/renovatebot/osv-offline/actions/workflows/build.yml)
+[![MIT license](https://img.shields.io/badge/license-MIT-blue?style=for-the-badge)](./LICENSE)
+
+## License
+
+This package is licensed under [the MIT license](https://opensource.org/licenses/MIT).
+
+Vulnerabilities are provided from the following upstream data sources and licenses:
+
+- [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md))
+- [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE))
+- [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license))
+- [Rust Advisory Database](https://github.com/RustSec/advisory-db) ([CC0 1.0](https://github.com/rustsec/advisory-db/blob/main/LICENSE.txt))
+- [Global Security Database](https://github.com/cloudsecurityalliance/gsd-database) ([CC0 1.0](https://github.com/cloudsecurityalliance/gsd-database/blob/main/LICENSE))
+- [OSS-Fuzz](https://github.com/google/oss-fuzz-vulns) ([CC-BY 4.0](https://github.com/google/oss-fuzz-vulns/blob/main/LICENSE))

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { OsvOfflineDb } from './lib/db';
+export { Ecosystem, ecosystems } from './lib/ecosystem';
+export * as Osv from './lib/osv';

package/dist/index.js

@@ -0,0 +1,41 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Osv = exports.ecosystems = exports.OsvOfflineDb = void 0;
+var db_1 = require("./lib/db");
+Object.defineProperty(exports, "OsvOfflineDb", { enumerable: true, get: function () { return db_1.OsvOfflineDb; } });
+var ecosystem_1 = require("./lib/ecosystem");
+Object.defineProperty(exports, "ecosystems", { enumerable: true, get: function () { return ecosystem_1.ecosystems; } });
+exports.Osv = __importStar(require("./lib/osv"));

package/dist/lib/db.d.ts

@@ -0,0 +1,10 @@
+import { Ecosystem } from './ecosystem';
+import type { Osv } from '..';
+export declare class OsvOfflineDb {
+    static readonly rootDirectory: string;
+    private db;
+    private constructor();
+    private initialize;
+    static create(): Promise<OsvOfflineDb>;
+    query(ecosystem: Ecosystem, packageName: string): Promise<Osv.Vulnerability[]>;
+}

package/dist/lib/db.js

@@ -0,0 +1,44 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OsvOfflineDb = void 0;
+const os_1 = require("os");
+const path_1 = __importDefault(require("path"));
+const nedb_1 = __importDefault(require("@seald-io/nedb"));
+const ecosystem_1 = require("./ecosystem");
+const purl_helper_1 = require("./purl-helper");
+class OsvOfflineDb {
+    static rootDirectory = process.env.OSV_OFFLINE_ROOT_DIR ?? path_1.default.join((0, os_1.tmpdir)(), 'osv-offline');
+    db = {};
+    // eslint-disable-next-line @typescript-eslint/no-empty-function
+    constructor() { }
+    async initialize() {
+        for (const ecosystem of ecosystem_1.ecosystems) {
+            this.db[ecosystem] = new nedb_1.default({
+                filename: path_1.default.join(OsvOfflineDb.rootDirectory, `${ecosystem.toLowerCase()}.nedb`),
+            });
+            await this.db[ecosystem].loadDatabaseAsync();
+        }
+    }
+    static async create() {
+        const osvOfflineDb = new OsvOfflineDb();
+        await osvOfflineDb.initialize();
+        return osvOfflineDb;
+    }
+    async query(ecosystem, packageName) {
+        return await this.db[ecosystem].findAsync({
+            affected: {
+                $elemMatch: {
+                    package: {
+                        name: packageName,
+                        ecosystem,
+                        purl: (0, purl_helper_1.packageToPurl)(ecosystem, packageName),
+                    },
+                },
+            },
+        });
+    }
+}
+exports.OsvOfflineDb = OsvOfflineDb;

package/dist/lib/ecosystem.d.ts

@@ -0,0 +1,2 @@
+export declare const ecosystems: readonly ["crates.io", "Go", "Hackage", "Hex", "Maven", "npm", "NuGet", "Packagist", "Pub", "PyPI", "RubyGems"];
+export type Ecosystem = (typeof ecosystems)[number];

package/dist/lib/ecosystem.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ecosystems = void 0;
+// https://github.com/google/osv.dev/blob/b8ec0096f93f062993dee57f8b902f257993be88/osv/ecosystems/_ecosystems.py#L38-L68
+exports.ecosystems = [
+    'crates.io',
+    'Go',
+    'Hackage',
+    'Hex',
+    'Maven',
+    'npm',
+    'NuGet',
+    'Packagist',
+    'Pub',
+    'PyPI',
+    'RubyGems',
+];

package/dist/lib/osv.d.ts

@@ -0,0 +1,63 @@
+/**
+ * A schema for describing a vulnerability in an open source package.
+ *
+ * https://github.com/ossf/osv-schema/blob/main/validation/schema.json
+ */
+export interface Vulnerability {
+    schema_version?: string;
+    id: string;
+    modified: string;
+    published?: string;
+    withdrawn?: string;
+    aliases?: string[];
+    related?: string[];
+    summary?: string;
+    details?: string;
+    severity?: Severity[];
+    affected?: Affected[];
+    references?: Reference[];
+    credits?: Credit[];
+    database_specific?: Record<string, unknown>;
+}
+export interface Affected {
+    package?: Package;
+    severity?: Severity[];
+    ranges?: Range[];
+    versions?: string[];
+    ecosystem_specific?: Record<string, unknown>;
+    database_specific?: Record<string, unknown>;
+}
+export interface Severity {
+    type: SeverityType;
+    score: string;
+}
+export type SeverityType = 'CVSS_V4' | 'CVSS_V3' | 'CVSS_V2';
+export interface Package {
+    ecosystem: string;
+    name: string;
+    purl?: string;
+}
+export interface Range {
+    type: RangeType;
+    repo?: string;
+    events: Event[];
+    database_specific?: Record<string, unknown>;
+}
+export type RangeType = 'ECOSYSTEM' | 'GIT' | 'SEMVER';
+export interface Event {
+    introduced?: string;
+    fixed?: string;
+    last_affected?: string;
+    limit?: string;
+}
+export interface Reference {
+    type: ReferenceType;
+    url: string;
+}
+export interface Credit {
+    name: string;
+    contact?: string[];
+    type: CreditType;
+}
+export type ReferenceType = 'ADVISORY' | 'ARTICLE' | 'DETECTION' | 'DISCUSSION' | 'REPORT' | 'FIX' | 'GIT' | 'INTRODUCED' | 'PACKAGE' | 'EVIDENCE' | 'WEB';
+export type CreditType = 'FINDER' | 'REPORTER' | 'ANALYST' | 'COORDINATOR' | 'REMEDIATION_DEVELOPER' | 'REMEDIATION_REVIEWER' | 'REMEDIATION_VERIFIER' | 'TOOL' | 'SPONSOR' | 'OTHER';

package/dist/lib/osv.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/lib/purl-helper.d.ts

@@ -0,0 +1,2 @@
+import type { Ecosystem } from './ecosystem';
+export declare function packageToPurl(ecosystem: Ecosystem, packageName: string): string;

package/dist/lib/purl-helper.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.packageToPurl = packageToPurl;
+// https://github.com/google/osv.dev/blob/edacbd3c32b1d632bad8c5b506a14d0850b2e537/osv/purl_helpers.py#L18-L30
+const PURL_ECOSYSTEMS = {
+    'crates.io': 'cargo',
+    Go: 'golang',
+    Hackage: 'hackage',
+    Hex: 'hex',
+    Maven: 'maven',
+    NuGet: 'nuget',
+    npm: 'npm',
+    Packagist: 'composer',
+    PyPI: 'pypi',
+    Pub: 'pub',
+    RubyGems: 'gem',
+};
+function urlEncode(packageName) {
+    const parts = packageName.split('/');
+    return parts.map(encodeURIComponent).join('/');
+}
+function packageToPurl(ecosystem, packageName) {
+    let packageNamePurl = packageName;
+    const purlType = PURL_ECOSYSTEMS[ecosystem];
+    if (purlType === 'maven') {
+        packageNamePurl = packageName.replace(':', '/');
+    }
+    return `pkg:${purlType}/${urlEncode(packageNamePurl)}`;
+}

package/package.json

@@ -0,0 +1,28 @@
+{
+  "name": "@renovatebot/osv-offline-db",
+  "version": "1.0.0-next.1",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "license": "MIT",
+  "type": "commonjs",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/renovatebot/osv-offline.git"
+  },
+  "dependencies": {
+    "@seald-io/nedb": "^4.1.2"
+  },
+  "devDependencies": {
+    "@tsconfig/node18": "18.2.4",
+    "@tsconfig/strictest": "2.0.6",
+    "@types/fs-extra": "11.0.4",
+    "@types/node": "18.19.129",
+    "fs-extra": "11.3.2"
+  },
+  "engines": {
+    "node": ">=18.12.0"
+  }
+}