fix: align osv-sync with ADR-0001 §OSV data conventions

Two fixes derived from the alignment audit against ADR-0001 (Joana's
oss-packages living ADR, merged in PR #4151):

1. Lowercase ecosystem ('Maven' -> 'maven')

ADR-0001 §OSV "Ecosystem normalization" stores ecosystems lowercase
('npm' and 'maven', not 'Maven'). The OSV worker preserved OSV's
titlecase 'Maven' on the way in, leaving 7,957 Maven rows in
advisory_packages that would never join correctly against a
lowercase-storing packages table.

Changes:
- parseOsvRecord lowercases the ecosystem at the OSV boundary before
  allowlist check, splitName, and storage. Allowlist set is lowercase
  in env (OSV_ECOSYSTEMS=npm,maven) and in tests.
- splitName branches on 'maven' instead of 'Maven'.
- deriveCriticalFlag.ts catch-up SQL CASE expression uses 'maven'.
- New migration V1779951727 backfills existing Maven rows in
  advisory_packages (and packages, which is empty today but reads
  cheaply).

2. Populate advisories.source and source_url

The consolidated initial schema has two columns the upsert path didn't
set: source ('OSV' for everything this worker writes; granular GHSA /
NVD / NSWG attribution belongs to the future deps.dev BQ worker) and
source_url (canonical OSV URL: https://osv.dev/vulnerability/<id>).

Changes:
- NormalizedAdvisory grew source: string and sourceUrl: string | null.
- parseOsvRecord sets source: 'OSV' and sourceUrl: osvSourceUrl(id).
- upsertAdvisory INSERT and ON CONFLICT UPDATE include both columns.

All 68 unit tests still pass; migration applied locally and confirmed
the existing Maven rows backfilled to maven without unique-index
collisions.

Signed-off-by: Joan Reyero <joan@reyero.io>

Author: joanreyero

backend/.env.dist.local

@@ -186,7 +186,7 @@ ENRICHER_IDLE_SLEEP_SEC=60
 
 # osv-sync (Temporal-scheduled; see services/apps/packages_worker/src/osv/schedule.ts)
 OSV_BULK_BASE_URL=https://osv-vulnerabilities.storage.googleapis.com
-OSV_ECOSYSTEMS=npm,Maven
+OSV_ECOSYSTEMS=npm,maven
 OSV_TMP_DIR=/tmp/osv
 OSV_BATCH_SIZE=500
 OSV_DERIVE_BATCH_SIZE=1000

backend/src/osspckgs/migrations/V1779951727__align_advisory_ecosystem_lowercase.sql

@@ -0,0 +1,16 @@
+-- Per ADR-0001 §OSV "Ecosystem normalization", ecosystem values stored in
+-- packages-db are lowercase: 'npm' and 'maven' (never 'Maven'). The OSV worker
+-- originally preserved OSV's titlecase 'Maven'; this migration backfills
+-- existing rows. Safe because there are no rows with both 'Maven' and 'maven'
+-- for the same (advisory_id, ecosystem, package_name) tuple — the worker has
+-- only ever written one case.
+UPDATE advisory_packages
+SET ecosystem = LOWER(ecosystem)
+WHERE ecosystem <> LOWER(ecosystem);
+
+-- packages.ecosystem is populated by the npm/Maven registry workers, not by
+-- osv-sync. It's normalized at write time in those workers, but the LOWER()
+-- backfill is cheap and idempotent so we include it here for completeness.
+UPDATE packages
+SET ecosystem = LOWER(ecosystem)
+WHERE ecosystem <> LOWER(ecosystem);

services/apps/packages_worker/src/osv/__tests__/deriveCriticalFlag.integration.test.ts

@@ -39,7 +39,7 @@ const FIXTURES: Record<string, FixturePackage> = {
   // log4shell ranges include [2.13.0, 2.15.0). 2.14.1 in, 2.17.0 above the
   // related CVE-2021-45046/45105 chain too.
   log4j: {
-    ecosystem: 'Maven',
+    ecosystem: 'maven',
     namespace: 'org.apache.logging.log4j',
     name: 'log4j-core',
     latest_version: '2.14.1',

services/apps/packages_worker/src/osv/__tests__/parseOsvRecord.test.ts

@@ -3,7 +3,7 @@ import { describe, expect, it } from 'vitest'
 import { parseOsvRecord } from '../parseOsvRecord'
 import { OsvRecord } from '../types'
 
-const ALLOW = new Set(['npm', 'Maven'])
+const ALLOW = new Set(['npm', 'maven'])
 
 const baseRecord = (overrides: Partial<OsvRecord>): OsvRecord => ({
   id: 'GHSA-test',
@@ -23,7 +23,7 @@ describe('parseOsvRecord — name splitting', () => {
     const out = parseOsvRecord(r, ALLOW)
     expect(out.packages).toHaveLength(1)
     expect(out.packages[0].pkg).toMatchObject({
-      ecosystem: 'Maven',
+      ecosystem: 'maven',
       packageName: 'org.apache.logging.log4j:log4j-core',
       namespace: 'org.apache.logging.log4j',
       name: 'log4j-core',

services/apps/packages_worker/src/osv/deriveCriticalFlag.ts

@@ -59,7 +59,7 @@ async function resolveMissingPackageIds(qx: QueryExecutor): Promise<number> {
       AND ap.ecosystem = p.ecosystem
       AND ap.package_name = CASE
         WHEN p.namespace IS NULL THEN p.name
-        WHEN p.ecosystem = 'Maven' THEN p.namespace || ':' || p.name
+        WHEN p.ecosystem = 'maven' THEN p.namespace || ':' || p.name
         WHEN p.ecosystem = 'npm' THEN '@' || p.namespace || '/' || p.name
         ELSE p.name
       END

services/apps/packages_worker/src/osv/parseOsvRecord.ts

@@ -70,6 +70,11 @@ export type CvssSource =
 
 export interface NormalizedAdvisory {
   osvId: string
+  // ADR-0001 §OSV / advisories.source — 'OSV' for everything ingested by this
+  // worker. The granular 'GHSA' | 'NVD' | 'NSWG' attribution is the deps.dev
+  // BQ ingestion worker's responsibility, not this one.
+  source: string
+  sourceUrl: string | null
   aliases: string[]
   severity: string | null
   cvss: number | null

services/apps/packages_worker/src/osv/types.ts

@@ -30,11 +30,15 @@ async function upsertOne(qx: QueryExecutor, record: NormalizedRecord): Promise<v
   const advisoryRow = await qx.selectOne(
     `
     INSERT INTO advisories
-      (osv_id, aliases, severity, cvss, cvss_source, summary, details, published_at, modified_at)
+      (osv_id, source, source_url, aliases, severity, cvss, cvss_source,
+       summary, details, published_at, modified_at)
     VALUES
-      ($(osvId), $(aliases)::text[], $(severity), $(cvss), $(cvssSource),
-       $(summary), $(details), $(publishedAt)::timestamptz, $(modifiedAt)::timestamptz)
+      ($(osvId), $(source), $(sourceUrl), $(aliases)::text[], $(severity),
+       $(cvss), $(cvssSource), $(summary), $(details),
+       $(publishedAt)::timestamptz, $(modifiedAt)::timestamptz)
     ON CONFLICT (osv_id) DO UPDATE SET
+      source       = EXCLUDED.source,
+      source_url   = EXCLUDED.source_url,
       aliases      = EXCLUDED.aliases,
       severity     = EXCLUDED.severity,
       cvss         = EXCLUDED.cvss,