Problem

The OSV reporting schema for PyPI packages had two issues that caused validation failures:

1. Incorrect ecosystem case: PyPI packages were using lowercase "pypi" instead of the proper case "PyPI" required by the OSV schema
2. Wrong range type: PyPI packages were using "SEMVER" range type, but PyPI ecosystem doesn't support SEMVER ranges and should use "ECOSYSTEM" instead

This resulted in OSV schema validation errors like:

invalid OSV: ecosystem "PyPI" does not support `SEMVER` ranges

Solution

1. Added proper ecosystem mapping for OSV schema

Created a separate osvEcosystemMap that provides the correct case-sensitive ecosystem names:

var osvEcosystemMap = map[packagev1.Ecosystem]string{
    packagev1.Ecosystem_ECOSYSTEM_PYPI:     "PyPI",      // Proper case
    packagev1.Ecosystem_ECOSYSTEM_NPM:      "npm",
    packagev1.Ecosystem_ECOSYSTEM_RUBYGEMS: "RubyGems",
    // ... other ecosystems
}

2. Added conditional range type logic

PyPI packages now use ECOSYSTEM range type while other ecosystems continue using SEMVER:

rangeType := osvschema.RangeSemVer
if report.GetPackageVersion().GetPackage().GetEcosystem() == packagev1.Ecosystem_ECOSYSTEM_PYPI {
    rangeType = osvschema.RangeEcosystem
}

3. Preserved file path generation

The existing maliciousPackagesEcosystemMap remains unchanged to ensure file paths continue using lowercase (e.g., osv/malicious/pypi/package/...).

Result

PyPI packages now generate valid OSV schema:

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "adcv"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ]
}

Testing

• Added comprehensive tests verifying PyPI uses "PyPI" ecosystem and "ECOSYSTEM" range type
• Added tests ensuring other ecosystems (NPM) continue using "SEMVER" range type
• All existing tests pass, confirming no regressions
• Manual verification confirms correct JSON output

Fixes the OSV schema validation issues for PyPI packages while maintaining backward compatibility for file generation and other ecosystems.

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.