@renovatebot/osv-offline 1.0.0-next.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2021 Jamie Magee <jamie.magee@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,18 @@
+# osv-offline
+
+[![Package version](https://img.shields.io/npm/v/@renovatebot/osv-offline?style=for-the-badge)](https://www.npmjs.com/package/@renovatebot/osv-offline)
+[![Build status](https://img.shields.io/github/actions/workflow/status/renovatebot/osv-offline/build.yml?branch=main&style=for-the-badge)](https://github.com/renovatebot/osv-offline/actions/workflows/build.yml)
+[![MIT license](https://img.shields.io/badge/license-MIT-blue?style=for-the-badge)](./LICENSE)
+
+## License
+
+This package is licensed under [the MIT license](https://opensource.org/licenses/MIT).
+
+Vulnerabilities are provided from the following upstream data sources and licenses:
+
+- [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md))
+- [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE))
+- [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license))
+- [Rust Advisory Database](https://github.com/RustSec/advisory-db) ([CC0 1.0](https://github.com/rustsec/advisory-db/blob/main/LICENSE.txt))
+- [Global Security Database](https://github.com/cloudsecurityalliance/gsd-database) ([CC0 1.0](https://github.com/cloudsecurityalliance/gsd-database/blob/main/LICENSE))
+- [OSS-Fuzz](https://github.com/google/oss-fuzz-vulns) ([CC-BY 4.0](https://github.com/google/oss-fuzz-vulns/blob/main/LICENSE))

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export { Osv, Ecosystem } from '@renovatebot/osv-offline-db';
+export { OsvOffline } from './lib/osv-offline';

package/dist/index.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OsvOffline = exports.Osv = void 0;
+var osv_offline_db_1 = require("@renovatebot/osv-offline-db");
+Object.defineProperty(exports, "Osv", { enumerable: true, get: function () { return osv_offline_db_1.Osv; } });
+var osv_offline_1 = require("./lib/osv-offline");
+Object.defineProperty(exports, "OsvOffline", { enumerable: true, get: function () { return osv_offline_1.OsvOffline; } });

package/dist/lib/download.d.ts

@@ -0,0 +1,2 @@
+import { Result } from './types';
+export declare function tryDownloadDb(): Promise<Result>;

package/dist/lib/download.js

@@ -0,0 +1,45 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tryDownloadDb = tryDownloadDb;
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const got_1 = __importDefault(require("got"));
+const promises_1 = require("node:stream/promises");
+const osv_offline_db_1 = require("@renovatebot/osv-offline-db");
+const path_1 = __importDefault(require("path"));
+const luxon_1 = require("luxon");
+const adm_zip_1 = __importDefault(require("adm-zip"));
+const types_1 = require("./types");
+async function tryDownloadDb() {
+    await fs_extra_1.default.ensureDir(osv_offline_db_1.OsvOfflineDb.rootDirectory);
+    if (process.env.OSV_OFFLINE_DISABLE_DOWNLOAD?.toLowerCase() === 'true') {
+        return (0, types_1.success)();
+    }
+    // if local database exists and is less than a day old, don't do any network requests
+    let stats;
+    try {
+        stats = await fs_extra_1.default.stat(path_1.default.join(osv_offline_db_1.OsvOfflineDb.rootDirectory, `osv-offline.zip`));
+    }
+    catch {
+        // ignored
+    }
+    if (stats !== undefined &&
+        luxon_1.DateTime.utc().diff(luxon_1.DateTime.fromJSDate(stats.mtime)).as('days') < 1) {
+        return (0, types_1.success)();
+    }
+    // only download databases if local databases are missing or remote is newer
+    try {
+        const stream = got_1.default.stream('https://github.com/renovatebot/osv-offline/releases/latest/download/osv-offline.zip');
+        const zipPath = path_1.default.join(osv_offline_db_1.OsvOfflineDb.rootDirectory, 'osv-offline.zip');
+        const writeStream = fs_extra_1.default.createWriteStream(zipPath);
+        await (0, promises_1.pipeline)(stream, writeStream);
+        const zip = new adm_zip_1.default(zipPath);
+        zip.extractAllTo(osv_offline_db_1.OsvOfflineDb.rootDirectory);
+    }
+    catch (err) {
+        return (0, types_1.failure)(err);
+    }
+    return (0, types_1.success)();
+}

package/dist/lib/osv-offline.d.ts

@@ -0,0 +1,21 @@
+import { Ecosystem, Osv } from '@renovatebot/osv-offline-db';
+export declare class OsvOffline {
+    private osvOfflineDb;
+    protected constructor();
+    /**
+     * Asynchronous code required as part of class instantiation
+     */
+    private initialize;
+    /**
+     * Asynchronously creates a new instance of {@link OsvOffline}
+     * @returns A new instance of {@link OsvOffline}
+     */
+    static create(): Promise<OsvOffline>;
+    /**
+     * Query the local database for any package vulnerabilities
+     * @param ecosystem The package ecosystem
+     * @param packageName The package name
+     * @returns An array of {@link Osv.Vulnerability} or an empty array if none are found
+     */
+    getVulnerabilities(ecosystem: Ecosystem, packageName: string): Promise<Osv.Vulnerability[]>;
+}

package/dist/lib/osv-offline.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OsvOffline = void 0;
+const osv_offline_db_1 = require("@renovatebot/osv-offline-db");
+const download_1 = require("./download");
+class OsvOffline {
+    osvOfflineDb;
+    // eslint-disable-next-line @typescript-eslint/no-empty-function
+    constructor() { }
+    /**
+     * Asynchronous code required as part of class instantiation
+     */
+    async initialize() {
+        const result = await (0, download_1.tryDownloadDb)();
+        if (!result.success) {
+            throw result.error;
+        }
+        this.osvOfflineDb = await osv_offline_db_1.OsvOfflineDb.create();
+    }
+    /**
+     * Asynchronously creates a new instance of {@link OsvOffline}
+     * @returns A new instance of {@link OsvOffline}
+     */
+    static async create() {
+        const instance = new OsvOffline();
+        await instance.initialize();
+        return instance;
+    }
+    /**
+     * Query the local database for any package vulnerabilities
+     * @param ecosystem The package ecosystem
+     * @param packageName The package name
+     * @returns An array of {@link Osv.Vulnerability} or an empty array if none are found
+     */
+    async getVulnerabilities(ecosystem, packageName) {
+        return this.osvOfflineDb.query(ecosystem, packageName);
+    }
+}
+exports.OsvOffline = OsvOffline;

package/dist/lib/types.d.ts

@@ -0,0 +1,11 @@
+interface Success {
+    success: true;
+}
+interface Failure {
+    success: false;
+    error: Error;
+}
+export type Result = Success | Failure;
+export declare function success(): Success;
+export declare function failure(error: Error): Failure;
+export {};

package/dist/lib/types.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.success = success;
+exports.failure = failure;
+function success() {
+    return { success: true };
+}
+function failure(error) {
+    return { success: false, error };
+}

package/package.json

@@ -0,0 +1,31 @@
+{
+  "name": "@renovatebot/osv-offline",
+  "version": "1.0.0-next.1",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "license": "MIT",
+  "type": "commonjs",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/renovatebot/osv-offline.git"
+  },
+  "dependencies": {
+    "adm-zip": "~0.5.16",
+    "fs-extra": "^11.3.2",
+    "got": "^11.8.6",
+    "luxon": "^3.7.2",
+    "@renovatebot/osv-offline-db": "1.0.0-next.1"
+  },
+  "devDependencies": {
+    "@types/adm-zip": "0.5.7",
+    "@types/fs-extra": "11.0.4",
+    "@types/luxon": "3.7.1",
+    "@types/node": "18.19.129"
+  },
+  "engines": {
+    "node": ">=18.12.0"
+  }
+}