internal/client: allow flat list of OSV as db

Allows a user of govulncheck to pass in a folder containing OSV JSON
files as a database.

Under the hood, we index the files and create an in-memory index. The
bulk of this logic is in a new type, hybridSource.

This is currently a hidden, experimental feature.

Change-Id: Ic1cc5f02badf2e3a51024eb3e6e9e3d7cf69b576
TryBot-Result: Gopher Robot <>
Reviewed-by: Julie Qiu <>
Run-TryBot: Tatiana Bradley <>
6 files changed
tree: 3728196a7613cfad3929aee3730b79256055c08c
  1. cmd/
  2. devtools/
  3. doc/
  4. internal/
  5. scan/
  6. .gitignore
  7. all_test.go
  8. checks.bash
  10. go.mod
  11. go.sum

Go Vulnerability Management

Go Reference

This repository contains packages for accessing and analyzing data from the Go Vulnerability Database.

See for more information about the Go vulnerability management system.

Privacy Policy

The privacy policy for govulncheck can be found at


Unless otherwise noted, the Go source files are distributed under the BSD-style license found in the LICENSE file.

Database entries available at are distributed under the terms of the CC-BY 4.0 license.