refactor: more provenance

vulnfeeds/cmd/combine-to-osv/main.go

@@ -614,12 +614,41 @@ func getExtractedEvents(r *osvschema.Range) []*structpb.Value {
 	return val.GetListValue().GetValues()
 }
 
-func parseExtractedEvent(v *structpb.Value) ExtractedEvent {
+func parseExtractedEvent(v *structpb.Value) []ExtractedEvent {
 	s := v.GetStructValue()
 	if s == nil {
-		return ExtractedEvent{}
+		return nil
 	}
 	fields := s.GetFields()
+
+	if rangeVal, ok := fields["range"]; ok && rangeVal.GetListValue() != nil {
+		var events []ExtractedEvent
+		for _, evVal := range rangeVal.GetListValue().GetValues() {
+			evS := evVal.GetStructValue()
+			if evS == nil {
+				continue
+			}
+			evFields := evS.GetFields()
+			var ev ExtractedEvent
+			if intro, ok := evFields["introduced"]; ok {
+				ev.Introduced = intro.GetStringValue()
+			}
+			if fixed, ok := evFields["fixed"]; ok {
+				ev.Fixed = fixed.GetStringValue()
+			}
+			if la, ok := evFields["last_affected"]; ok {
+				ev.LastAffected = la.GetStringValue()
+			}
+			if lim, ok := evFields["limit"]; ok {
+				ev.Limit = lim.GetStringValue()
+			}
+			events = append(events, ev)
+		}
+
+		return events
+	}
+
+	// Fallback to old flat structure (single event)
 	var ev ExtractedEvent
 	if intro, ok := fields["introduced"]; ok {
 		ev.Introduced = intro.GetStringValue()
@@ -634,17 +663,21 @@ func parseExtractedEvent(v *structpb.Value) ExtractedEvent {
 		ev.Limit = lim.GetStringValue()
 	}
 
-	return ev
+	if ev != (ExtractedEvent{}) {
+		return []ExtractedEvent{ev}
+	}
+
+	return nil
 }
 
 func parseExtractedEvents(r *osvschema.Range) []ExtractedEvent {
 	rawValues := getExtractedEvents(r)
 	if len(rawValues) == 0 {
 		return nil
 	}
-	events := make([]ExtractedEvent, 0, len(rawValues))
+	var events []ExtractedEvent
 	for _, val := range rawValues {
-		events = append(events, parseExtractedEvent(val))
+		events = append(events, parseExtractedEvent(val)...)
 	}
 
 	return events
@@ -695,6 +728,24 @@ func isCPERange(r *osvschema.Range) bool {
 	if fields == nil {
 		return false
 	}
+
+	// Check new location inside extracted_events first
+	if extractedEventsVal, ok := fields["extracted_events"]; ok && extractedEventsVal.GetListValue() != nil {
+		for _, groupVal := range extractedEventsVal.GetListValue().GetValues() {
+			groupS := groupVal.GetStructValue()
+			if groupS == nil {
+				continue
+			}
+			groupFields := groupS.GetFields()
+			if sourceVal, ok := groupFields["source"]; ok {
+				if sourceVal.GetStringValue() == "CPE_RANGE" {
+					return true
+				}
+			}
+		}
+	}
+
+	// Fallback to old location
 	val, ok := fields["source"]
 	if !ok {
 		return false

vulnfeeds/conversion/common.go

@@ -230,14 +230,17 @@ func GitVersionsToCommits(versionRanges []models.RangeWithMetadata, repos []stri
 				}
 				successfulRepos = append(successfulRepos, repo)
 				if len(vr.Range.GetEvents()) > 0 {
-					dbSpecificMap := map[string]any{
-						"extracted_events": vr.Range.GetEvents(),
+					extractedEventGroup := map[string]any{
+						"range": vr.Range.GetEvents(),
 					}
 					if vr.Metadata.CPE != "" {
-						dbSpecificMap["cpe"] = vr.Metadata.CPE
+						extractedEventGroup["cpe"] = vr.Metadata.CPE
 					}
 					if string(vr.Metadata.Source) != "" {
-						dbSpecificMap["source"] = string(vr.Metadata.Source)
+						extractedEventGroup["source"] = string(vr.Metadata.Source)
+					}
+					dbSpecificMap := map[string]any{
+						"extracted_events": []any{extractedEventGroup},
 					}
 					databaseSpecific, err := utility.NewStructpbFromMap(dbSpecificMap)
 					if err != nil {
@@ -495,6 +498,7 @@ func CreateUnresolvedRanges(unresolvedRanges []models.RangeWithMetadata) *struct
 	type key struct {
 		Source        string
 		VendorProduct string
+		OriginalTag   string
 	}
 
 	rangesByKey := make(map[key][]models.RangeWithMetadata)
@@ -509,7 +513,7 @@ func CreateUnresolvedRanges(unresolvedRanges []models.RangeWithMetadata) *struct
 				vendorProduct = ur.Metadata.CPE
 			}
 		}
-		k := key{Source: string(ur.Metadata.Source), VendorProduct: vendorProduct}
+		k := key{Source: string(ur.Metadata.Source), VendorProduct: vendorProduct, OriginalTag: ur.Metadata.OriginalTag}
 		if _, ok := rangesByKey[k]; !ok {
 			keys = append(keys, k)
 		}
@@ -520,8 +524,11 @@ func CreateUnresolvedRanges(unresolvedRanges []models.RangeWithMetadata) *struct
 		if a.Source != b.Source {
 			return strings.Compare(a.Source, b.Source)
 		}
+		if a.VendorProduct != b.VendorProduct {
+			return strings.Compare(a.VendorProduct, b.VendorProduct)
+		}
 
-		return strings.Compare(a.VendorProduct, b.VendorProduct)
+		return strings.Compare(a.OriginalTag, b.OriginalTag)
 	})
 
 	listElements := make([]any, 0, len(keys))
@@ -562,14 +569,21 @@ func CreateUnresolvedRanges(unresolvedRanges []models.RangeWithMetadata) *struct
 		if k.VendorProduct != "" {
 			unresolvedRangesMap["vendor_product"] = k.VendorProduct
 		}
-		if k.Source != "" {
-			unresolvedRangesMap["source"] = k.Source
-		}
 		if len(cpes) > 0 {
 			unresolvedRangesMap["cpes"] = cpes
 		}
 
-		unresolvedRangesMap["extracted_events"] = events
+		extractedEventGroup := map[string]any{
+			"range": events,
+		}
+		if k.Source != "" {
+			extractedEventGroup["source"] = k.Source
+		}
+		if k.OriginalTag != "" {
+			extractedEventGroup["original_tag"] = k.OriginalTag
+		}
+
+		unresolvedRangesMap["extracted_events"] = []any{extractedEventGroup}
 		listElements = append(listElements, unresolvedRangesMap)
 	}
 

vulnfeeds/conversion/common_test.go

@@ -381,7 +381,6 @@ func TestCreateUnresolvedRanges(t *testing.T) {
 							StructValue: &structpb.Struct{
 								Fields: map[string]*structpb.Value{
 									"vendor_product": structpb.NewStringValue("another:app"),
-									"source":         structpb.NewStringValue(string(models.VersionSourceCPE)),
 									"cpes": structpb.NewListValue(&structpb.ListValue{
 										Values: []*structpb.Value{
 											structpb.NewStringValue("cpe:2.3:a:another:app:*:*:*:*:*:*:*:*"),
@@ -395,7 +394,20 @@ func TestCreateUnresolvedRanges(t *testing.T) {
 														Kind: &structpb.Value_StructValue{
 															StructValue: &structpb.Struct{
 																Fields: map[string]*structpb.Value{
-																	"fixed": structpb.NewStringValue("2.0"),
+																	"source": structpb.NewStringValue(string(models.VersionSourceCPE)),
+																	"range": structpb.NewListValue(&structpb.ListValue{
+																		Values: []*structpb.Value{
+																			{
+																				Kind: &structpb.Value_StructValue{
+																					StructValue: &structpb.Struct{
+																						Fields: map[string]*structpb.Value{
+																							"fixed": structpb.NewStringValue("2.0"),
+																						},
+																					},
+																				},
+																			},
+																		},
+																	}),
 																},
 															},
 														},
@@ -413,7 +425,6 @@ func TestCreateUnresolvedRanges(t *testing.T) {
 							StructValue: &structpb.Struct{
 								Fields: map[string]*structpb.Value{
 									"vendor_product": structpb.NewStringValue("example:app"),
-									"source":         structpb.NewStringValue(string(models.VersionSourceDescription)),
 									"cpes": structpb.NewListValue(&structpb.ListValue{
 										Values: []*structpb.Value{
 											structpb.NewStringValue("cpe:2.3:a:example:app:*:*:*:*:*:*:*:*"),
@@ -427,7 +438,20 @@ func TestCreateUnresolvedRanges(t *testing.T) {
 														Kind: &structpb.Value_StructValue{
 															StructValue: &structpb.Struct{
 																Fields: map[string]*structpb.Value{
-																	"introduced": structpb.NewStringValue("1.0"),
+																	"source": structpb.NewStringValue(string(models.VersionSourceDescription)),
+																	"range": structpb.NewListValue(&structpb.ListValue{
+																		Values: []*structpb.Value{
+																			{
+																				Kind: &structpb.Value_StructValue{
+																					StructValue: &structpb.Struct{
+																						Fields: map[string]*structpb.Value{
+																							"introduced": structpb.NewStringValue("1.0"),
+																						},
+																					},
+																				},
+																			},
+																		},
+																	}),
 																},
 															},
 														},