GO-2025-4149: OSV-SCALIBR has NULL Pointer Dereference in github.com/google/osv-scalibr

annotator

package

v0.3.0 Latest Latest Go to latest Published: Jun 12, 2025 License: Apache-2.0 Imports: 4 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/google/osv-scalibr

Links

Open Source Insights

Documentation ¶

Overview ¶

Package annotator provides the interface for annotation plugins.

Index ¶

func Run(ctx context.Context, config *Config, inventory *inventory.Inventory) ([]*plugin.Status, error)
type Annotator
type Config
type ScanInput

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func Run ¶

func Run(ctx context.Context, config *Config, inventory *inventory.Inventory) ([]*plugin.Status, error)

Run runs the specified annotators on the scan results and returns their statuses.

Types ¶

type Annotator ¶

type Annotator interface {
	plugin.Plugin
	// Annotate annotates the scan results with additional information.
	Annotate(ctx context.Context, input *ScanInput, results *inventory.Inventory) error
}

Annotator is the interface for an annotation plugin, used to add additional information to scan results such as VEX statements. Annotators have access to the filesystem but should ideally not query any external APIs. If you need to modify the scan results based on the output of network calls you should use the Enricher interface instead.

type Config ¶

type Config struct {
	Annotators []Annotator
	ScanRoot   *scalibrfs.ScanRoot
}

Config stores the config settings for the annotation run.

type ScanInput ¶

type ScanInput struct {
	// The root of the artifact being scanned.
	ScanRoot *scalibrfs.ScanRoot
}

ScanInput provides information for the annotator about the scan.

Source Files ¶

View all Source files

annotator.go

Directories ¶

Path	Synopsis
cachedir Package cachedir implements an annotator for packages that are in cache directories.	Package cachedir implements an annotator for packages that are in cache directories.
list Package list provides a list of annotation plugins.	Package list provides a list of annotation plugins.
osduplicate
dpkg Package dpkg implements an annotator for language packages that have already been found in DPKG OS packages.	Package dpkg implements an annotator for language packages that have already been found in DPKG OS packages.

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL