Repository navigation
fedcode-next: Extract fix commits from pull requests and issues body or comments in search for CVE-related messages #2002
Description
Activity
These PRs need to be reviewed so we can close this issue. once you have a time, please take a look:
@ziadhany aboutcode-data/vulnerablecode-vcs-collector#1 this need tests, on package-url/packageurl-python#223 there are already some comments by Philippe, please coordinate on resolving them first
This is done, now we can collect issues and PRs in Github and Gitlab. We have a new project named vulnerablecode-vcs-collector at https://github.com/aboutcode-data/vulnerablecode-vcs-collector that is designed to collect fix commits from VCS histories
This has been merged with:
The current implementation works from hardcoded list of packages. The future improvements will drive that directly from PURLs collected in a CVE or driven from the larger PurlDB. These future improvements are tracked in a separate issue:
Metadata
Metadata
Assignees
Labels
Type
Projects
- Status
Implement a pipeline that extracts fix commits from pull requests, issue descriptions, and comments.
The pipeline should search for vulnerability-related messages and security fix indicators using, for example, the GitHub or GitLab API.