Generate android artifact - #49293
Conversation
There was a problem hiding this comment.
Pull request overview
Adds Android support to Fleet’s cmd/osv-processor so it can generate gzipped OSV-derived vulnerability artifacts for Android, alongside existing Ubuntu and RHEL processing.
Changes:
- Adds
--platform androidmode with default input dir/tmp/android-osvand anrunAndroidprocessing pipeline. - Introduces Android-specific artifact schema/types and writes per-Android-version artifacts named
osv-android-<ver>-<date>.json.gz. - Adds unit tests covering Android range parsing, CVE extraction, deduplication, filtering, and artifact generation.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| cmd/osv-processor/main.go | Adds Android platform mode, parsing/aggregation logic, and Android artifact writer/types. |
| cmd/osv-processor/main_test.go | Adds tests for Android processing behavior and artifact output. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| type AndroidVuln struct { | ||
| CVE string `json:"cve"` | ||
| FixedSPL string `json:"fixed_spl"` // YYYY-MM-DD date when the fix was included | ||
| Severity string `json:"severity,omitempty"` | ||
| } |
There was a problem hiding this comment.
Neither concern exists in the data:
Zero non-zero introduced value. Every Android CVE is introduced: <ver>:0, meaning "affected from the beginning." There's no "introduced after SPL X" case.
Zero disjoint ranges within a single affected entry. Multi-version entries use separate events (introduced: 15:0, fixed: 15:2026-05-01, introduced: 16:0, fixed: 16:2026-05-01) which our parser already handles correctly by extracting each (major, fixed_spl) pair.
WalkthroughThe OSV processor now supports an 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
cmd/osv-processor/main.go (1)
943-962: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueMinor: anonymous struct type repeated.
The
{major, fixedSPL string}shape is declared twice (slice declaration and append literal). A small named type would remove the duplication.♻️ Optional cleanup
+type androidFixedEvent struct { + major string + fixedSPL string +} + ... - var fixedEvents []struct { - major string - fixedSPL string - } + var fixedEvents []androidFixedEvent for _, event := range r.Events { ... - fixedEvents = append(fixedEvents, struct { - major string - fixedSPL string - }{major, spl}) + fixedEvents = append(fixedEvents, androidFixedEvent{major, spl}) }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@cmd/osv-processor/main.go` around lines 943 - 962, Define a named type for the fixed Android event entries near the fixedEvents declaration, then use it for both the fixedEvents slice and the append literal in this loop. Preserve the existing major and fixedSPL fields and behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@cmd/osv-processor/main.go`:
- Around line 840-845: The isAndroidVersion function currently accepts path
traversal and malformed prefixes by checking only the first character. Replace
that check with strict validation allowing only the documented Android version
forms (numeric major versions with an optional decimal component or trailing L),
and reject separators, traversal characters, and other suffixes before the value
reaches the output filename path.
- Around line 825-838: Update the Android severity fixture in
cmd/osv-processor/main_test.go:1567-1606 from “Medium” to the valid Android ASB
severity “Moderate”; no direct change is needed in androidSeverityRank in
cmd/osv-processor/main.go:825-838.
---
Nitpick comments:
In `@cmd/osv-processor/main.go`:
- Around line 943-962: Define a named type for the fixed Android event entries
near the fixedEvents declaration, then use it for both the fixedEvents slice and
the append literal in this loop. Preserve the existing major and fixedSPL fields
and behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: f62052ca-1742-49ec-ac16-ce86f6822603
📒 Files selected for processing (2)
cmd/osv-processor/main.gocmd/osv-processor/main_test.go
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## 35075-software-os-show-android-versions-and-vulnerabilities #49293 +/- ##
===============================================================================================
+ Coverage 67.97% 67.99% +0.02%
===============================================================================================
Files 3801 3805 +4
Lines 239965 240843 +878
Branches 12693 12693
===============================================================================================
+ Hits 163123 163773 +650
- Misses 62058 62191 +133
- Partials 14784 14879 +95
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
This what the output of running the artifact job looks like: |
| filesProcessed := 0 | ||
| filesSkipped := 0 | ||
|
|
||
| err := filepath.Walk(cfg.InputDir, func(path string, info os.FileInfo, err error) error { |
There was a problem hiding this comment.
nit: Since the only file metadata you are using here is info.IsDir() you could use filepath.WalkDir here instead and avoid issuing an extra sys call per file.
| } | ||
| log.Printf("Total Android CVEs across all versions: %d", totalCVEs) | ||
|
|
||
| for ver, cveMap := range collected { |
There was a problem hiding this comment.
Do we want to return early here and/or print a log line if collected is empty?
|
|
||
| for _, r := range affected.Ranges { | ||
| if r.Type != "ECOSYSTEM" { | ||
| continue |
There was a problem hiding this comment.
What are your thoughts about keeping a record of what was skipped because conditions like this?
...
skippedNonEcosystem++
continue
...
skippedNonFixed++
continue
....
log.Printf("Total: %d, Skipped entries — non-Android ecosystem: %d, non-fixed: %d, totalEntries, skippedNonEcosystem, skippedNonFixed)
LMKWYT
There was a problem hiding this comment.
good call. I will change it to log a bit more to be safe.
2026/07/15 11:53:48 Processing Android OSV files from /tmp/android-osv-sample/extracted
2026/07/15 11:53:48 Processed 500 files...
2026/07/15 11:53:48 Processed 1000 files...
2026/07/15 11:53:48 Processed 1500 files...
2026/07/15 11:53:48 Processed 2000 files...
2026/07/15 11:53:48 Processed 2500 files...
2026/07/15 11:53:48 Processed 3000 files...
2026/07/15 11:53:48 Processed 3403 files, skipped 0 files in 512ms
2026/07/15 11:53:48 Affected entries: 7424 total, skipped — non-Android ecosystem: 0, non-ECOSYSTEM range: 0, non-version prefix: 1683
2026/07/15 11:53:48 Discovered 12 Android versions
2026/07/15 11:53:48 Total Android CVEs across all versions: 4358
2026/07/15 11:53:48 Android 15: 351 CVEs -> /tmp/android-osv-output5/osv-android-15-2026-07-15.json.gz
2026/07/15 11:53:48 Android 16: 224 CVEs -> /tmp/android-osv-output5/osv-android-16-2026-07-15.json.gz
2026/07/15 11:53:48 Android 17: 67 CVEs -> /tmp/android-osv-output5/osv-android-17-2026-07-15.json.gz
2026/07/15 11:53:48 Android 11: 574 CVEs -> /tmp/android-osv-output5/osv-android-11-2026-07-15.json.gz
2026/07/15 11:53:48 Android 8.1: 160 CVEs -> /tmp/android-osv-output5/osv-android-8.1-2026-07-15.json.gz
2026/07/15 11:53:48 Android 13: 760 CVEs -> /tmp/android-osv-output5/osv-android-13-2026-07-15.json.gz
2026/07/15 11:53:48 Android 14: 451 CVEs -> /tmp/android-osv-output5/osv-android-14-2026-07-15.json.gz
2026/07/15 11:53:48 Android 9: 202 CVEs -> /tmp/android-osv-output5/osv-android-9-2026-07-15.json.gz
2026/07/15 11:53:48 Android 10: 382 CVEs -> /tmp/android-osv-output5/osv-android-10-2026-07-15.json.gz
2026/07/15 11:53:48 Android 8.0: 85 CVEs -> /tmp/android-osv-output5/osv-android-8.0-2026-07-15.json.gz
2026/07/15 11:53:48 Android 12: 601 CVEs -> /tmp/android-osv-output5/osv-android-12-2026-07-15.json.gz
2026/07/15 11:53:48 Android 12L: 501 CVEs -> /tmp/android-osv-output5/osv-android-12L-2026-07-15.json.gz
2026/07/15 11:53:48 Android processing completed in 518ms
This is what the new output will look like,
|
|
||
| return &artifact, nil | ||
| } | ||
|
|
There was a problem hiding this comment.
There are a couple of gaps here in testing:
- Every test that hits the dedup branch uses identical severities, so the androidSeverityRank(...) > precedence is never exercised.
- Real Android entries carry GIT ranges beside ECOSYSTEM ones; no test feeds one.
- No test mixes in a different ecosystem. Give the non-Android entry a version-like fixed event and assert no phantom artifact is produced.
- --exclude-versions mode. Only inclusive --versions is tested; the exclusion branch is untested.
juan-fdz-hawa
left a comment
juan-fdz-hawa
left a comment
There was a problem hiding this comment.
LGTM! None of the comments are blocking, just nits/improvements - I'll leave it to you if you want to implement them.
02ac22a
into
35075-software-os-show-android-versions-and-vulnerabilities
Related issue: Resolves #47335
Checklist for submitter
SELECT *is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters.Testing
Summary by CodeRabbit