Struct Spec 

pub struct Spec<V: 'static> {
    pub ecosystem: &'static str,
    pub range_type: &'static str,
    pub parse_version: fn(&str) -> Option<V>,
    pub normalize_name: fn(&str) -> String,
    pub use_versions: bool,
    pub severity: fn(&OsvRecord) -> (Severity, Option<f32>),
}

The per-ecosystem knobs the generic load/advisories_from need. Everything else (wire schema, parallel reader, indexing, parse-once) is shared.

Fields

ecosystem: &'static str

The OSV affected[].package.ecosystem string this feeder consumes (e.g. "Maven").

range_type: &'static str

The OSV range type this feeder evaluates ("ECOSYSTEM" or "SEMVER"); other types are not matchable.

parse_version: fn(&str) -> Option<V>

Parse a bound/version string with this ecosystem’s version adapter (incl. its "0" convention). Used at load to pre-parse range bounds and the enumerated versions.

normalize_name: fn(&str) -> String

Normalize a package name into the index key (identity, lowercase, PEP 503, URL, …).

use_versions: bool

Whether to collect the enumerated versions list (false for npm, which is range-only).

severity: fn(&OsvRecord) -> (Severity, Option<f32>)

Derive (severity, cvss_score) from a record. default_severity suits every feeder whose records carry the GHSA band / CVSS_V3 vector; npm passes its own.