An air-gapped instance reads licenses from a vendor directory instead of the network. v3 changes that directory's layout, so the v2 reader cannot read it. A v3 reader already exists for malware and nothing in it is malware specific, so this is a rename plus wiring it into the licenses path. [!251674](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/251674) delivers this: `LicenseV3SyncService` merged with #622511 raising `NotImplementedError` for its offline connector, and that MR renames the reader, moves the hook onto `V3SyncService`, and drops the licenses override, so licenses read a v3 vendor directory. The v2 to v3 flip itself belongs to [#606527](https://gitlab.com/gitlab-org/gitlab/-/work_items/606527) (which absorbed #611126). ## Plan **The connector: [!251674](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/251674).** `MalwareOffline` becomes the dataset-neutral v3 offline connector. [`malware_offline.rb#L16-38`](https://gitlab.com/gitlab-org/gitlab/-/blob/2a5a9c020af5236cc0fc5dbd543b32492525a28a/ee/lib/gitlab/package_metadata/connector/malware_offline.rb#L16-38) has no data-type check anywhere and its layout matches the v3 licenses bucket exactly, the whole body is the v3 `full_dataset` layout. Only three files reference the constant: the class, its spec, and one call site at [`malware_advisory_sync_service.rb#L286`](https://gitlab.com/gitlab-org/gitlab/-/blob/2a5a9c020af5236cc0fc5dbd543b32492525a28a/ee/app/services/package_metadata/malware_advisory_sync_service.rb#L286). Follow [!249566](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/249566), which did the same extraction for the PDS connector: neutral name without the dataset, old spec kept untouched to assert parity. Also in this MR, the layout comment fix and the spec gap: [`malware_offline.rb#L8-9`](https://gitlab.com/gitlab-org/gitlab/-/blob/2a5a9c020af5236cc0fc5dbd543b32492525a28a/ee/lib/gitlab/package_metadata/connector/malware_offline.rb#L8-9) tells admins to unpack into `<purl_type>/`, but [`base_connector.rb#L30-38`](https://gitlab.com/gitlab-org/gitlab/-/blob/2a5a9c020af5236cc0fc5dbd543b32492525a28a/ee/lib/gitlab/package_metadata/connector/base_connector.rb#L30-38) builds the path from `registry_id`. Three purl types rename: `gem`→`rubygem`, `golang`→`go`, `composer`→`packagist`. An admin following the comment builds `v3/gem/` and gets an empty sync with no log line. The spec only exercises `npm`, the one registry where both strings match, so cover a renaming registry. Small and quick on purpose: [!250919](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/250919) is editing `malware_advisory_sync_service.rb` right around the call site, so the conflict window should stay short. **The flip: closed.** [!251687](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/251687) implemented runtime v3-directory detection in `license_configs`, the wrong seam per [#622511's cutover plan](https://gitlab.com/gitlab-org/gitlab/-/work_items/622511#note_3732988816): the cutover is `LicenseSyncWorker` flipping to the extracted v3 sync service with the config pinned v3, one clean commit under [#606527](https://gitlab.com/gitlab-org/gitlab/-/work_items/606527). The flip ships there. ## Scope - [ ] [!251674](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/251674) (in review): the v3 vendor reader is dataset neutral, `V3SyncService` supplies it to every dataset, licenses no longer raise for it, the `purl_type`/`registry_id` comment is fixed, and the spec covers a renaming registry and a licenses config. - [ ] Docs ([!251824](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/251824), in review): the v3 vendor layout and upgrade step documented, merge-blocked on !250674 and !251527 until #606527's cutover MR exists. - [ ] The v2 to v3 flip ships with #606527's cutover MR (!251687 closed as the wrong seam). ## Notes - Keep the v2 reader rather than breaking existing setups. v1 was retired by draining the bucket, not by breaking readers: `VERSION_FORMAT_V1` is still defined, still in the enum, and `Location.for_licenses:134-135` still falls back to the pre-16.2 `OLD_LICENSES_PATH`. A breaking change here needs the six-month deprecation process, an automated fallback does not. - `Location.for_licenses` needs no change. `BaseConnector#file_prefix` appends `<version_format>/<registry_id>`, and the vendor directory already wins over the network path. - Filling the directory is already solved. The licenses bucket is public and the documented `gsutil rsync` cron excludes only `^v1/`, so it already mirrors `v3/`. Neither [#594758](https://gitlab.com/gitlab-org/gitlab/-/work_items/594758) nor [#611178](https://gitlab.com/gitlab-org/gitlab/-/work_items/611178) blocks this, both are malware-only. Worth stating in the docs that the mirror grows from 1.82 GiB to about 2.3 GiB and that `-d` deletes anything not in source. - The connector is a pure file reader, all parsing is downstream. v3 payload parsing and persistence are ifrenkel's [!250673](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/250673)/[!250674](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/250674) and do not overlap MRs 1 and 2 beyond the trivial predicate conflict above. [!250978](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/250978) (read path) is irrelevant to this issue. - [!250979](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/250979) adds a skipped-record count, which is not the same as logging a mislaid vendor directory (tracked in [#602417](https://gitlab.com/gitlab-org/gitlab/-/work_items/602417)). It counts records read and then rejected, and it guards on `return if count == 0`, so an empty read still emits nothing.