🌱 Set OSV User-Agent for scorecard cli and cron workers. (ossf#4883)

* Set OSV User-Agent for scorecard cli and cron workers.

Signed-off-by: kash2104 <kparikh1104@gmail.com>

* Initialise client with OSV UserAgent.

Signed-off-by: kash2104 <kparikh1104@gmail.com>

---------

Signed-off-by: kash2104 <kparikh1104@gmail.com>

Author: kash2104

clients/osv.go

@@ -30,7 +30,22 @@ import (
 var _ VulnerabilitiesClient = osvClient{}
 
 type osvClient struct {
-	local bool
+	requestUserAgent string
+	local            bool
+}
+
+type OSVConfig struct {
+	UserAgent         string
+	ExperimentalLocal bool
+}
+
+func NewOSVClient(config *OSVConfig) VulnerabilitiesClient {
+	cfg := osvClient{}
+	if config != nil {
+		cfg.local = config.ExperimentalLocal
+		cfg.requestUserAgent = config.UserAgent
+	}
+	return cfg
 }
 
 // ListUnfixedVulnerabilities implements VulnerabilityClient.ListUnfixedVulnerabilities.
@@ -54,6 +69,12 @@ func (v osvClient) ListUnfixedVulnerabilities(
 	if commit != "" {
 		gitCommits = append(gitCommits, commit)
 	}
+
+	exp := osvscanner.ExperimentalScannerActions{
+		PluginsEnabled:   []string{"python/requirements"},
+		PluginsDisabled:  []string{"python/requirementsenhanceable"},
+		RequestUserAgent: v.requestUserAgent,
+	}
 	res, err := osvscanner.DoScan(osvscanner.ScannerActions{
 		DirectoryPaths:    directoryPaths,
 		IncludeGitRoot:    false,
@@ -62,10 +83,7 @@ func (v osvClient) ListUnfixedVulnerabilities(
 		CompareOffline:    v.local,
 		DownloadDatabases: v.local,
 		// swap out the transitive requirements scanning for offline extractor
-		ExperimentalScannerActions: osvscanner.ExperimentalScannerActions{
-			PluginsEnabled:  []string{"python/requirements"},
-			PluginsDisabled: []string{"python/requirementsenhanceable"},
-		},
+		ExperimentalScannerActions: exp,
 	}) // TODO: Do logging?
 
 	response := VulnerabilitiesResponse{}
@@ -86,8 +104,8 @@ func (v osvClient) ListUnfixedVulnerabilities(
 				continue
 			}
 			response.Vulnerabilities = append(response.Vulnerabilities, Vulnerability{
-				ID:      vulns[i].Vulnerability.ID,
-				Aliases: vulns[i].Vulnerability.Aliases,
+				ID:      vulns[i].Vulnerability.GetId(),
+				Aliases: vulns[i].Vulnerability.GetAliases(),
 			})
 			// Remove duplicate vulnerability IDs for now as we don't report information
 			// on the source of each vulnerability yet, therefore having multiple identical

clients/vulnerabilities.go

@@ -29,7 +29,7 @@ type VulnerabilitiesClient interface {
 
 // DefaultVulnerabilitiesClient returns a new OSV Vulnerabilities client.
 func DefaultVulnerabilitiesClient() VulnerabilitiesClient {
-	return osvClient{local: false}
+	return NewOSVClient(nil)
 }
 
 // ExperimentalLocalOSVClient returns an OSV Vulnerabilities client which

cmd/root.go

@@ -24,6 +24,7 @@ import (
 	"sort"
 	"strings"
 
+	"github.com/google/osv-scanner/v2/pkg/osvscanner"
 	"github.com/spf13/cobra"
 	"sigs.k8s.io/release-utils/version"
 
@@ -170,12 +171,19 @@ func rootCmd(o *options.Options) error {
 
 	enabledProbes := o.Probes()
 
+	info := version.GetVersionInfo()
+	actions := osvscanner.ExperimentalScannerActions{}
+	config := clients.OSVConfig{}
+	actions.RequestUserAgent = fmt.Sprintf("scorecard-cli/%s", info.GitVersion)
+	config.UserAgent = actions.RequestUserAgent
+
 	opts := []scorecard.Option{
 		scorecard.WithLogLevel(sclog.ParseLevel(o.LogLevel)),
 		scorecard.WithCommitSHA(o.Commit),
 		scorecard.WithCommitDepth(o.CommitDepth),
 		scorecard.WithProbes(enabledProbes),
 		scorecard.WithChecks(checks),
+		scorecard.WithVulnerabilitiesClient(clients.NewOSVClient(&config)),
 	}
 	if strings.EqualFold(o.FileMode, options.FileModeGit) {
 		opts = append(opts, scorecard.WithFileModeGit())

cron/internal/worker/main.go

@@ -26,7 +26,9 @@ import (
 	"os"
 	"strings"
 
+	"github.com/google/osv-scanner/v2/pkg/osvscanner"
 	"go.opencensus.io/stats/view"
+	"sigs.k8s.io/release-utils/version"
 
 	"github.com/ossf/scorecard/v5/checker"
 	"github.com/ossf/scorecard/v5/clients"
@@ -97,7 +99,7 @@ type ScorecardWorker struct {
 	blacklistedChecks []string
 }
 
-func newScorecardWorker() (*ScorecardWorker, error) {
+func newScorecardWorker(vulnsClient clients.VulnerabilitiesClient) (*ScorecardWorker, error) {
 	var err error
 	sw := &ScorecardWorker{}
 	if sw.checkDocs, err = docs.Read(); err != nil {
@@ -132,7 +134,7 @@ func newScorecardWorker() (*ScorecardWorker, error) {
 	if sw.ossFuzzRepoClient, err = ossfuzz.CreateOSSFuzzClientEager(ossfuzz.StatusURL); err != nil {
 		return nil, fmt.Errorf("ossfuzz.CreateOSSFuzzClientEager: %w", err)
 	}
-	sw.vulnsClient = clients.DefaultVulnerabilitiesClient()
+	sw.vulnsClient = vulnsClient
 
 	apiBaseURL, err := config.GetAPIBaseURL()
 	if err != nil {
@@ -368,11 +370,17 @@ func getPurger(logger *log.Logger, apiBaseURL string) cdn.Purger {
 }
 
 func main() {
+	info := version.GetVersionInfo()
+	actions := osvscanner.ExperimentalScannerActions{}
+	actions.RequestUserAgent = fmt.Sprintf("scorecard-cron/%s", info.GitVersion)
+	osvConfig := clients.OSVConfig{}
+	osvConfig.UserAgent = actions.RequestUserAgent
+	vulnsClient := clients.NewOSVClient(&osvConfig)
 	flag.Parse()
 	if err := config.ReadConfig(); err != nil {
 		panic(err)
 	}
-	sw, err := newScorecardWorker()
+	sw, err := newScorecardWorker(vulnsClient)
 	if err != nil {
 		panic(err)
 	}

go.mod

@@ -1,6 +1,6 @@
 module github.com/ossf/scorecard/v5
 
-go 1.24.6
+go 1.25.5
 
 require (
 	cloud.google.com/go/bigquery v1.72.0
@@ -42,7 +42,7 @@ require (
 	github.com/caarlos0/env/v6 v6.10.1
 	github.com/gobwas/glob v0.2.3
 	github.com/google/go-github/v82 v82.0.0
-	github.com/google/osv-scanner/v2 v2.2.4
+	github.com/google/osv-scanner/v2 v2.3.2
 	github.com/hmarr/codeowners v1.2.1
 	github.com/in-toto/attestation v1.1.2
 	github.com/mcuadros/go-jsonschema-generator v0.0.0-20200330054847-ba7a369d4303
@@ -64,18 +64,18 @@ require (
 	cloud.google.com/go/pubsub/v2 v2.2.1 // indirect
 	cyphar.com/go-pathrs v0.2.1 // indirect
 	dario.cat/mergo v1.0.2 // indirect
-	deps.dev/api/v3 v3.0.0-20250917073939-6ff3dd7d2eea // indirect
-	deps.dev/api/v3alpha v0.0.0-20250903005441-604c45d5b44b // indirect
-	deps.dev/util/maven v0.0.0-20250917073939-6ff3dd7d2eea // indirect
+	deps.dev/api/v3 v3.0.0-20251219105704-58e32bc05c71 // indirect
+	deps.dev/api/v3alpha v0.0.0-20251219105704-58e32bc05c71 // indirect
+	deps.dev/util/maven v0.0.0-20251219105704-58e32bc05c71 // indirect
 	deps.dev/util/pypi v0.0.0-20250903005441-604c45d5b44b // indirect
-	deps.dev/util/resolve v0.0.0-20250917073939-6ff3dd7d2eea // indirect
-	deps.dev/util/semver v0.0.0-20250917073939-6ff3dd7d2eea // indirect
+	deps.dev/util/resolve v0.0.0-20251219105704-58e32bc05c71 // indirect
+	deps.dev/util/semver v0.0.0-20251219105704-58e32bc05c71 // indirect
 	github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 // indirect
 	github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20250520111509-a70c2aa677fa // indirect
-	github.com/BurntSushi/toml v1.5.0 // indirect
+	github.com/BurntSushi/toml v1.6.0 // indirect
 	github.com/CycloneDX/cyclonedx-go v0.9.3 // indirect
 	github.com/GehirnInc/crypt v0.0.0-20230320061759-8cc1b52080c5 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.30.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.54.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.54.0 // indirect
 	github.com/Masterminds/semver/v3 v3.4.0 // indirect
@@ -87,7 +87,7 @@ require (
 	github.com/bmatcuk/doublestar/v4 v4.9.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/cloudflare/circl v1.6.1 // indirect
-	github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 // indirect
+	github.com/cncf/xds/go v0.0.0-20251022180443-0feb69152e9f // indirect
 	github.com/compose-spec/compose-go/v2 v2.8.1 // indirect
 	github.com/containerd/cgroups/v3 v3.1.0 // indirect
 	github.com/containerd/containerd v1.7.29 // indirect
@@ -116,12 +116,12 @@ require (
 	github.com/edsrzf/mmap-go v1.2.0 // indirect
 	github.com/elliotwutingfeng/asciiset v0.0.0-20230602022725-51bbb787efab // indirect
 	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
-	github.com/envoyproxy/go-control-plane/envoy v1.32.4 // indirect
+	github.com/envoyproxy/go-control-plane/envoy v1.35.0 // indirect
 	github.com/envoyproxy/protoc-gen-validate v1.2.1 // indirect
 	github.com/erikvarga/go-rpmdb v0.0.0-20250523120114-a15a62cd4593 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/go-errors/errors v1.0.2 // indirect
-	github.com/go-jose/go-jose/v4 v4.1.2 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-ole/go-ole v1.2.6 // indirect
 	github.com/go-openapi/jsonpointer v0.20.2 // indirect
@@ -136,13 +136,13 @@ require (
 	github.com/google/gnostic-models v0.6.8 // indirect
 	github.com/google/go-github/v75 v75.0.0 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
-	github.com/google/osv-scalibr v0.3.7-0.20251023161426-90e9ac9cc1b3 // indirect
+	github.com/google/osv-scalibr v0.4.2-0.20260109123902-cf20290d7624 // indirect
 	github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
-	github.com/ianlancetaylor/demangle v0.0.0-20250628045327-2d64ad6b7ec5 // indirect
-	github.com/jedib0t/go-pretty/v6 v6.6.8 // indirect
+	github.com/ianlancetaylor/demangle v0.0.0-20251118225945-96ee0021ea0f // indirect
+	github.com/jedib0t/go-pretty/v6 v6.7.8 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/klauspost/cpuid/v2 v2.2.5 // indirect
@@ -166,9 +166,9 @@ require (
 	github.com/olekukonko/ll v0.0.9 // indirect
 	github.com/opencontainers/runtime-spec v1.2.1 // indirect
 	github.com/opencontainers/selinux v1.13.0 // indirect
-	github.com/ossf/osv-schema/bindings/go v0.0.0-20251012234424-434020c6442f // indirect
+	github.com/ossf/osv-schema/bindings/go v0.0.0-20251230224438-88c48750ddae // indirect
 	github.com/otiai10/mint v1.6.3 // indirect
-	github.com/owenrumney/go-sarif/v3 v3.2.3 // indirect
+	github.com/owenrumney/go-sarif/v3 v3.3.0 // indirect
 	github.com/package-url/packageurl-go v0.1.3 // indirect
 	github.com/pandatix/go-cvss v0.6.2 // indirect
 	github.com/pierrec/lz4/v4 v4.1.21 // indirect
@@ -186,7 +186,7 @@ require (
 	github.com/skeema/knownhosts v1.3.1 // indirect
 	github.com/spdx/gordf v0.0.0-20250128162952-000978ccd6fb // indirect
 	github.com/spdx/tools-golang v0.5.5 // indirect
-	github.com/spiffe/go-spiffe/v2 v2.5.0 // indirect
+	github.com/spiffe/go-spiffe/v2 v2.6.0 // indirect
 	github.com/thoas/go-funk v0.9.3 // indirect
 	github.com/tidwall/gjson v1.18.0 // indirect
 	github.com/tidwall/jsonc v0.3.2 // indirect
@@ -199,11 +199,10 @@ require (
 	github.com/ulikunitz/xz v0.5.15 // indirect
 	github.com/xhit/go-str2duration/v2 v2.1.0 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
-	github.com/zeebo/errs v1.4.0 // indirect
 	github.com/zeebo/xxh3 v1.0.2 // indirect
 	go.etcd.io/bbolt v1.4.3 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/detectors/gcp v1.37.0 // indirect
+	go.opentelemetry.io/contrib/detectors/gcp v1.38.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.62.0 // indirect
 	go.opentelemetry.io/otel v1.38.0 // indirect
@@ -216,13 +215,13 @@ require (
 	go.yaml.in/yaml/v4 v4.0.0-rc.3 // indirect
 	golang.org/x/mod v0.30.0 // indirect
 	golang.org/x/telemetry v0.0.0-20251111182119-bc8e575c7b54 // indirect
-	golang.org/x/term v0.37.0 // indirect
+	golang.org/x/term v0.39.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
 	golang.org/x/vuln v1.1.4 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20251111163417-95abcf5c77ba // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20251111163417-95abcf5c77ba // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20251222181119-0a764e51fe1b // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20251213004720-97cd9d5aeac2 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
-	gopkg.in/ini.v1 v1.67.0 // indirect
+	gopkg.in/ini.v1 v1.67.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/api v0.29.3 // indirect
@@ -235,7 +234,7 @@ require (
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect
 	modernc.org/sqlite v1.38.0 // indirect
-	osv.dev/bindings/go v0.0.0-20251013010847-b847e93bd9b0 // indirect
+	osv.dev/bindings/go v0.0.0-20260109041851-2d38aed9758f // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
 	sigs.k8s.io/yaml v1.6.0 // indirect
@@ -291,14 +290,14 @@ require (
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	go.uber.org/mock v0.6.0
-	golang.org/x/crypto v0.45.0 // indirect
+	golang.org/x/crypto v0.46.0 // indirect
 	golang.org/x/exp v0.0.0-20250911091902-df9299821621 // indirect
-	golang.org/x/net v0.47.0 // indirect
+	golang.org/x/net v0.48.0 // indirect
 	golang.org/x/oauth2 v0.34.0
 	golang.org/x/sync v0.19.0 // indirect
-	golang.org/x/sys v0.39.0 // indirect
+	golang.org/x/sys v0.40.0 // indirect
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
 	google.golang.org/api v0.256.0 // indirect
-	google.golang.org/grpc v1.76.0 // indirect
+	google.golang.org/grpc v1.78.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 )