pub static OSV_DATABASES: &[DownloadFile]Expand description
The OSV per-ecosystem databases this build provisions.
The layout is not ours to choose: osv-scanner --local-db-path <dir> looks
for <dir>/osv-scalibr/<ECOSYSTEM>/all.zip, with the ecosystem spelled
exactly as OSV spells it (crates.io, not cargo; PyPI, not pypi).
Four ecosystems, because that is what ADR-0018’s matrix asks of this
analyzer: Python, Java and Node are the gap it closes, and crates.io is
what makes the Rust cross-reference with cargo-audit possible at all.
npm/all.zip alone is roughly 210 MB, and the four together are around
260 MB — a real provisioning cost, disclosed by prefetch before it fetches
anything.