From 2620be5ef2c62693f5feb8e40ae7c98631b0be9c Mon Sep 17 00:00:00 2001 From: krishsharma955 Date: Fri, 4 Sep 2026 21:30:23 +0530 Subject: [PATCH 1/2] Fix silent error swallowing in cmd/main.go MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Handle the error returned by os.ReadFile() in insert_purls instead of discarding it with _. Previously, if a data file could not be read, zero PURLs were silently inserted into the FST with no indication of failure. 🤖 Generated with Codebuff Co-Authored-By: Codebuff Signed-off-by: krishsharma955 --- cmd/main.go | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/cmd/main.go b/cmd/main.go index fd09a09..a15389f 100644 --- a/cmd/main.go +++ b/cmd/main.go @@ -55,9 +55,11 @@ func main() { } func insert_purls(builder *vellum.Builder, file string) int { - var err error // #nosec G304 - data, _ := os.ReadFile(file) + data, err := os.ReadFile(file) + if err != nil { + log.Fatal(err) + } lines := strings.FieldsFunc(string(data), func(r rune) bool { return r == '\n' }) From bf63459ee09403f5b080c7d8cbf2f2594f4a2511 Mon Sep 17 00:00:00 2001 From: krishsharma955 Date: Sat, 5 Sep 2026 09:32:45 +0530 Subject: [PATCH 2/2] Replace log.Fatal with error propagation in library init and fix file leak MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replace init() with sync.Once lazy initialization in purlvalidator.go so the library no longer crashes consumers on FST load failure. Add defer f.Close() in cmd/main.go to prevent file descriptor leak. 🤖 Generated with Codebuff Co-Authored-By: Codebuff --- cmd/main.go | 1 + purlvalidator.go | 25 ++++++++++++++++--------- 2 files changed, 17 insertions(+), 9 deletions(-) diff --git a/cmd/main.go b/cmd/main.go index a15389f..2de10a2 100644 --- a/cmd/main.go +++ b/cmd/main.go @@ -27,6 +27,7 @@ func main() { if err != nil { log.Fatal(err) } + defer f.Close() dirname := "cmd/data/" entries, err := os.ReadDir(dirname) diff --git a/purlvalidator.go b/purlvalidator.go index 6c609c8..524e814 100644 --- a/purlvalidator.go +++ b/purlvalidator.go @@ -14,7 +14,7 @@ package purlvalidator import ( _ "embed" "fmt" - "log" + "sync" "github.com/blevesearch/vellum" "github.com/package-url/packageurl-go" @@ -23,14 +23,17 @@ import ( //go:embed purls.fst var fstData []byte -var validator *vellum.FST +var ( + validator *vellum.FST + validatorOnce sync.Once + validatorErr error +) -func init() { - var err error - validator, err = vellum.Load(fstData) - if err != nil { - log.Fatal(err) - } +func getValidator() (*vellum.FST, error) { + validatorOnce.Do(func() { + validator, validatorErr = vellum.Load(fstData) + }) + return validator, validatorErr } func validate_purl(packageURL string, fstMap *vellum.FST) (bool, error) { @@ -47,5 +50,9 @@ func validate_purl(packageURL string, fstMap *vellum.FST) (bool, error) { } func Validate(packageURL string) (bool, error) { - return validate_purl(packageURL, validator) + v, err := getValidator() + if err != nil { + return false, err + } + return validate_purl(packageURL, v) }