fix comments

Author: crosleyzack

src/vunnel/providers/chainguard/__init__.py

@@ -27,8 +27,6 @@ class Config:
     osv_url: str = "https://packages.cgr.dev/chainguard/v2/osv/all.json"
     # Override with VUNNEL_PROVIDERS_CHAINGUARD_USE_OSV
     use_osv: bool = False
-    # Override with VUNNEL_PROVIDERS_CHAINGUARD_SKIP_REDOWNLOAD
-    skip_redownload: bool = False
     # Override with VUNNEL_PROVIDERS_CHAINGUARD_OSV_MAX_WORKERS
     osv_max_workers: int = 8
 
@@ -58,7 +56,7 @@ def __init__(self, root: str, config: Config | None = None):
                 namespace=self._namespace,
                 download_timeout=self.config.request_timeout,
                 logger=self.logger,
-                skip_redownload=self.config.skip_redownload,
+                skip_download=self.config.runtime.skip_download,
                 max_workers=self.config.osv_max_workers,
             )
             self.schema = schema.OSVSchema(version="1.7.0")
@@ -69,7 +67,7 @@ def __init__(self, root: str, config: Config | None = None):
                 namespace=self._namespace,
                 download_timeout=self.config.request_timeout,
                 logger=self.logger,
-                skip_redownload=self.config.skip_redownload,
+                skip_download=self.config.runtime.skip_download,
             )
             self.feed_url = self.config.secdb_url
             self.schema = schema.OSSchema()
@@ -85,6 +83,10 @@ def name(cls) -> str:
     def tags(cls) -> list[str]:
         return ["vulnerability", "os"]
 
+    @classmethod
+    def supports_skip_download(cls) -> bool:
+        return True
+
     def update(self, last_updated: datetime.datetime | None) -> tuple[list[str], int]:
         with timer(self.name(), self.logger):
             with self.results_writer() as writer, self.parser:

src/vunnel/providers/wolfi/parser.py

@@ -5,6 +5,7 @@
 import copy
 import logging
 import os
+import re
 from typing import TYPE_CHECKING, Any
 from urllib.parse import urlparse
 
@@ -13,7 +14,7 @@
 
 from vunnel.tool import fixdate
 from vunnel.utils import http_wrapper as http
-from vunnel.utils import vulnerability
+from vunnel.utils import vulnerability, osv
 
 if TYPE_CHECKING:
     from collections.abc import Generator
@@ -35,8 +36,8 @@ def __init__(  # noqa: PLR0913
         download_timeout: int = 125,
         logger: logging.Logger | None = None,
         security_reference_url: str | None = None,
-        skip_redownload: bool = False,
-        max_workers: int = 8,
+        skip_download: bool = False,
+        max_workers: int = 64,
     ):
         if not fixdater:
             fixdater = fixdate.default_finder(workspace)
@@ -49,7 +50,7 @@ def __init__(  # noqa: PLR0913
         self.security_reference_url = (
             security_reference_url.strip("/") if security_reference_url else self._security_reference_url_
         )
-        self.skip_redownload = skip_redownload
+        self.skip_download = skip_download
         self.max_workers = max_workers
 
         if not logger:
@@ -110,7 +111,7 @@ def __init__(# noqa: PLR0913
         download_timeout: int = 125,
         logger: logging.Logger | None = None,
         security_reference_url: str | None = None,
-        skip_redownload: bool = False,
+        skip_download: bool = False,
         max_workers: int = 8,
     ):
         self._db_filename = self._extract_filename_from_url(url)
@@ -122,11 +123,15 @@ def __init__(# noqa: PLR0913
             download_timeout,
             logger,
             security_reference_url,
-            skip_redownload=skip_redownload,
+            skip_download=skip_download,
             max_workers=max_workers,
         )
 
     def _download(self) -> None:
+        if self.skip_download:
+            self.logger.info(f"skip_download is enabled for {self.namespace} secdb feed")
+            return
+
         if not os.path.exists(self.input_dir_path):
             os.makedirs(self.input_dir_path, exist_ok=True)
 
@@ -136,11 +141,6 @@ def _download(self) -> None:
             self.logger.info(f"downloading {self.namespace} secdb {self.url}")
             r = http.get(self.url, self.logger, stream=True, timeout=self.download_timeout)
             file_path = os.path.join(self.input_dir_path, self._db_filename)
-            # if the file already exists and skip_redownload is True, skip writing the file again. This is to avoid
-            # unnecessary redownloading and rewriting of the same file, which can save time on subsequent runs.
-            if self.skip_redownload and os.path.exists(file_path):
-                self.logger.info(f"skipping download of {self.namespace} secdb since file already exists at {file_path}")
-                return
             with open(file_path, "wb") as fp:
                 for chunk in r.iter_content():
                     fp.write(chunk)
@@ -256,18 +256,23 @@ def _normalize(self, release: str, data: dict[str, Any]) -> dict[str, Any]:  # n
 
 class OSVParser(Parser):
     _input_dir_ = "osv"
+    _cga_id_re = re.compile(r"^CGA(-[23456789cfghjmpqrvwx]{4}){3}$")
 
     def _download(self) -> None:
         '''
         Download all OSV entry files based on the index file at self.url, which should point to the
         top level all.json file. For each entry in the index, we construct the URL for the individual
         entry file and download it to the input directory.
         '''
+        self.fixdater.download()
+
+        if self.skip_download:
+            self.logger.info(f"skip_download is enabled for {self.namespace} osv feed")
+            return
+
         if not os.path.exists(self.input_dir_path):
             os.makedirs(self.input_dir_path, exist_ok=True)
 
-        self.fixdater.download()
-
         try:
             self.logger.info(f"downloading {self.namespace} osv index {self.url}")
             # self.url should point to the top level all.json file, e.g.
@@ -281,10 +286,15 @@ def _download(self) -> None:
             # We construct the URL for each entry by appending the entry ID and .json to the base URL
             # e.g. https://packages.cgr.dev/chainguard/v2/osv/CGA-2255-2h2p-73q2.json
             with concurrent.futures.ThreadPoolExecutor(max_workers=self.max_workers) as executor:
-                futures = [
-                    executor.submit(self._download_single_file, f"{base_url}/{entry['id']}.json", f"{entry['id']}.json")
-                    for entry in index
-                ]
+                futures = []
+                for entry in index:
+                    entry_id = entry["id"]
+                    if not entry_id or not self._cga_id_re.match(entry_id):
+                        self.logger.warning(f"skipping osv entry with invalid id: {entry_id!r}")
+                        continue
+                    futures.append(
+                        executor.submit(self._download_single_file, f"{base_url}/{entry_id}.json", f"{entry_id}.json"),
+                    )
                 # surface the first exception (if any) — matches prior behavior where a single
                 # failure aborted the batch via the outer try/except
                 done, _not_done = concurrent.futures.wait(futures, return_when=concurrent.futures.FIRST_EXCEPTION)
@@ -298,12 +308,6 @@ def _download_single_file(self, url: str, filename: str) -> None:
         Download a single OSV entry file given its URL and the desired filename.
         '''
         file_path = os.path.join(self.input_dir_path, filename)
-        # if the file already exists and skip_redownload is True, skip writing the file again. This is to avoid
-        # unnecessary redownloading and rewriting of the same file, which can save time on subsequent
-        # runs.
-        if self.skip_redownload and os.path.exists(file_path):
-            self.logger.info(f"skipping download of {self.namespace} osv entry {filename} since file already exists")
-            return
         self.logger.info(f"downloading {self.namespace} osv entry {filename}")
         r = http.get(url, self.logger, stream=True, timeout=self.download_timeout)
         with open(file_path, "wb") as fp:
@@ -339,4 +343,5 @@ def _normalize(self, release: str, data: dict[str, Any]) -> dict[str, Any]:  # n
         # we map the osv id to the osv data to keep consistency in the secdb parser, which
         # does this for ease of identifying the associated vulnerability when writing records.
         # IE: {"CGA-1234-5678-9abc": {<full osv record>}}
+        osv.patch_fix_date(data, self.fixdater)
         return {data['id']: data}

tests/unit/providers/chainguard/test-fixtures/snapshots/osv/chainguard:rolling/CGA-224q-ccj5-2p53.json

@@ -24,6 +24,17 @@
         },
         "ranges": [
           {
+            "database_specific": {
+              "anchore": {
+                "fixes": [
+                  {
+                    "date": "2026-01-07",
+                    "kind": "advisory",
+                    "version": "2.2.34-r0"
+                  }
+                ]
+              }
+            },
             "events": [
               {
                 "introduced": "0"
@@ -44,6 +55,17 @@
         },
         "ranges": [
           {
+            "database_specific": {
+              "anchore": {
+                "fixes": [
+                  {
+                    "date": "2026-01-07",
+                    "kind": "advisory",
+                    "version": "2.8.18-r0"
+                  }
+                ]
+              }
+            },
             "events": [
               {
                 "introduced": "0"
@@ -64,6 +86,17 @@
         },
         "ranges": [
           {
+            "database_specific": {
+              "anchore": {
+                "fixes": [
+                  {
+                    "date": "2026-01-07",
+                    "kind": "advisory",
+                    "version": "3.0.10-r0"
+                  }
+                ]
+              }
+            },
             "events": [
               {
                 "introduced": "0"
@@ -84,6 +117,17 @@
         },
         "ranges": [
           {
+            "database_specific": {
+              "anchore": {
+                "fixes": [
+                  {
+                    "date": "2026-01-07",
+                    "kind": "advisory",
+                    "version": "3.1.7-r0"
+                  }
+                ]
+              }
+            },
             "events": [
               {
                 "introduced": "0"

tests/unit/providers/chainguard/test-fixtures/snapshots/osv/chainguard:rolling/CGA-22hv-wp9q-4779.json

@@ -24,6 +24,17 @@
         },
         "ranges": [
           {
+            "database_specific": {
+              "anchore": {
+                "fixes": [
+                  {
+                    "date": "2026-02-24",
+                    "kind": "advisory",
+                    "version": "3.153.0-r0"
+                  }
+                ]
+              }
+            },
             "events": [
               {
                 "introduced": "0"
@@ -57,6 +68,17 @@
         },
         "ranges": [
           {
+            "database_specific": {
+              "anchore": {
+                "fixes": [
+                  {
+                    "date": "2026-02-24",
+                    "kind": "advisory",
+                    "version": "3.152.0-r0"
+                  }
+                ]
+              }
+            },
             "events": [
               {
                 "introduced": "0"
@@ -77,6 +99,17 @@
         },
         "ranges": [
           {
+            "database_specific": {
+              "anchore": {
+                "fixes": [
+                  {
+                    "date": "2026-02-24",
+                    "kind": "advisory",
+                    "version": "3.153.0-r0"
+                  }
+                ]
+              }
+            },
             "events": [
               {
                 "introduced": "0"

tests/unit/providers/chainguard/test-fixtures/snapshots/osv/chainguard:rolling/CGA-xcpc-gm23-prj9.json

@@ -24,6 +24,17 @@
         },
         "ranges": [
           {
+            "database_specific": {
+              "anchore": {
+                "fixes": [
+                  {
+                    "date": "2026-02-20",
+                    "kind": "advisory",
+                    "version": "2.0.14-r1"
+                  }
+                ]
+              }
+            },
             "events": [
               {
                 "introduced": "0"
@@ -44,6 +55,17 @@
         },
         "ranges": [
           {
+            "database_specific": {
+              "anchore": {
+                "fixes": [
+                  {
+                    "date": "2026-02-20",
+                    "kind": "advisory",
+                    "version": "2.0.14-r1"
+                  }
+                ]
+              }
+            },
             "events": [
               {
                 "introduced": "0"
@@ -99,6 +121,17 @@
         },
         "ranges": [
           {
+            "database_specific": {
+              "anchore": {
+                "fixes": [
+                  {
+                    "date": "2026-02-20",
+                    "kind": "advisory",
+                    "version": "2.0.14-r1"
+                  }
+                ]
+              }
+            },
             "events": [
               {
                 "introduced": "0"

tests/unit/providers/chainguard/test_chainguard.py

@@ -46,19 +46,20 @@ def test_parser_selection(
 def test_config_propagates_to_parser(helpers, auto_fake_fixdate_finder, use_osv, expected_parser_cls):
     workspace = helpers.provider_workspace_helper(name=Provider.name())
 
-    c = Config(use_osv=use_osv, skip_redownload=True, osv_max_workers=16)
+    c = Config(use_osv=use_osv, osv_max_workers=16)
+    c.runtime.skip_download = True
     c.runtime.result_store = result.StoreStrategy.FLAT_FILE
     p = Provider(root=workspace.root, config=c)
 
     assert isinstance(p.parser, expected_parser_cls)
-    assert p.parser.skip_redownload is True
+    assert p.parser.skip_download is True
     if use_osv:
         assert p.parser.max_workers == 16
 
 
 def test_config_defaults():
     c = Config()
-    assert c.skip_redownload is False
+    assert c.runtime.skip_download is False
     assert c.osv_max_workers == 8