@@ -29,11 +29,13 @@ const (
2929 ecosystemsFilename = "ecosystems.txt"
3030)
3131
32+ // ecosystemWorker processes vulnerabilities for a single ecosystem.
3233type ecosystemWorker struct {
3334 ecosystem string
3435 inCh chan * osvschema.Vulnerability
3536}
3637
38+ // newEcosystemWorker creates and starts a new ecosystemWorker.
3739func newEcosystemWorker (ctx context.Context , ecosystem string , outCh chan <- writeMsg , wg * sync.WaitGroup ) * ecosystemWorker {
3840 ch := make (chan * osvschema.Vulnerability )
3941 worker := & ecosystemWorker {
@@ -46,6 +48,7 @@ func newEcosystemWorker(ctx context.Context, ecosystem string, outCh chan<- writ
4648 return worker
4749}
4850
51+ // vulnData holds the ID and marshalled JSON data for a vulnerability.
4952type vulnData struct {
5053 id string
5154 data []byte
@@ -55,6 +58,9 @@ var protoMarshaller = protojson.MarshalOptions{
5558 UseProtoNames : true , // TODO(michaelkedar): https://github.com/ossf/osv-schema/pull/442
5659}
5760
61+ // run is the main loop for the ecosystemWorker. It receives vulnerabilities,
62+ // aggregates them, and upon completion, writes out the ecosystem-specific
63+ // zip, csv, and (for GIT) vanir files.
5864func (w * ecosystemWorker ) run (ctx context.Context , outCh chan <- writeMsg , wg * sync.WaitGroup ) {
5965 defer wg .Done ()
6066 logger .Info ("new ecosystem worker started" , slog .String ("ecosystem" , w .ecosystem ))
@@ -115,20 +121,25 @@ func (w *ecosystemWorker) run(ctx context.Context, outCh chan<- writeMsg, wg *sy
115121 }
116122}
117123
124+ // Finish signals the worker to stop processing by closing its input channel.
118125func (w * ecosystemWorker ) Finish () {
119126 close (w .inCh )
120127}
121128
129+ // vulnAndEcos holds a vulnerability and the list of ecosystems it belongs to.
122130type vulnAndEcos struct {
123131 * osvschema.Vulnerability
124132
125133 ecosystems []string
126134}
127135
136+ // allEcosystemWorker processes all vulnerabilities from all ecosystems to create
137+ // the global export files.
128138type allEcosystemWorker struct {
129139 inCh chan vulnAndEcos
130140}
131141
142+ // newAllEcosystemWorker creates and starts a new allEcosystemWorker.
132143func newAllEcosystemWorker (ctx context.Context , outCh chan <- writeMsg , wg * sync.WaitGroup ) * allEcosystemWorker {
133144 ch := make (chan vulnAndEcos )
134145 worker := & allEcosystemWorker {
@@ -140,6 +151,8 @@ func newAllEcosystemWorker(ctx context.Context, outCh chan<- writeMsg, wg *sync.
140151 return worker
141152}
142153
154+ // run is the main loop for the allEcosystemWorker. It receives all vulnerabilities
155+ // and generates the global all.zip, modified_id.csv, and ecosystems.txt files.
143156func (w * allEcosystemWorker ) run (ctx context.Context , outCh chan <- writeMsg , wg * sync.WaitGroup ) {
144157 defer wg .Done ()
145158 logger .Info ("all-ecosystem worker started" )
@@ -177,17 +190,20 @@ func (w *allEcosystemWorker) run(ctx context.Context, outCh chan<- writeMsg, wg
177190 }
178191}
179192
193+ // Finish signals the worker to stop processing by closing its input channel.
180194func (w * allEcosystemWorker ) Finish () {
181195 close (w .inCh )
182196}
183197
198+ // write is a helper to send a writeMsg to the writer channel, handling context cancellation.
184199func write (ctx context.Context , path string , data []byte , mimeType string , outCh chan <- writeMsg ) {
185200 select {
186201 case outCh <- writeMsg {path : path , mimeType : mimeType , data : data }:
187202 case <- ctx .Done ():
188203 }
189204}
190205
206+ // writeModifiedIDCSV constructs and writes a modified_id.csv file.
191207func writeModifiedIDCSV (ctx context.Context , path string , csvData [][]string , outCh chan <- writeMsg ) {
192208 logger .Info ("constructing csv file" , slog .String ("path" , path ))
193209 slices .SortFunc (csvData , func (a , b []string ) int {
@@ -208,6 +224,7 @@ func writeModifiedIDCSV(ctx context.Context, path string, csvData [][]string, ou
208224 write (ctx , path , buf .Bytes (), "text/csv" , outCh )
209225}
210226
227+ // writeZIP constructs and writes an all.zip file.
211228func writeZIP (ctx context.Context , path string , allVulns []vulnData , outCh chan <- writeMsg ) {
212229 logger .Info ("constructing zip file" , slog .String ("path" , path ))
213230 slices .SortFunc (allVulns , func (a , b vulnData ) int {
@@ -233,6 +250,7 @@ func writeZIP(ctx context.Context, path string, allVulns []vulnData, outCh chan<
233250 write (ctx , path , buf .Bytes (), "application/zip" , outCh )
234251}
235252
253+ // writeVanir constructs and writes the osv_git.json file containing vulnerabilities with Vanir signatures.
236254func writeVanir (ctx context.Context , vanirVulns []vulnData , outCh chan <- writeMsg ) {
237255 slices .SortFunc (vanirVulns , func (a , b vulnData ) int { return cmp .Compare (a .id , b .id ) })
238256 vulns := make ([]json.RawMessage , len (vanirVulns ))
0 commit comments