Repository navigation
cravex2-reachability: Create code to extract and store symbols from fix commits in VulnerableCode #1965
Description
We need code to extract and store symbols from fix commits in VulnerableCode. This extraction is likely a job for ScanCode. It should leverage the inspectors.
Some data source like the Go advisories already have that data.
See many issues directly about this:
- Already done in the past VCIO-next: Add support to track fix commits: Include commits and patches that fix a vulnerability #207
- Infer Package URL from references and other references issues for "commitish" URLs #327
- fedcode-next: Improve tracking of fix commits #1695
- fedcode-next: Collect all fix commits #1703
- fedcode-next: Collect existing fix commits and patches open datasets #1697
- Collect fix commits from https://github.com/google/vulncode-db/ #118
- Add data and consider standard from security-patches-dataset and also process this convention #1891
- fedcode-next: Extract unpublished vulnerabilities from commit histories and trackers #1129
- some external https://github.com/s3c2/vfcfinder
Related issues that should likely need to considered together:
Metadata
Metadata
Assignees
Labels
No labels
Type
Projects
- Status
Activity
ziadhany commentedon Jun 3, 2026
@pombredanne should this be part of
or should I create a new pipeline for this?
ziadhany commentedon Aug 31, 2026
This is done now, we can extract patch symbols from vulnerability-fixing patches and commits
see:
[-]cravex2-reachability: Extract symbols from vulnerability-fixing patches and commits[/-][+]cravex2-reachability: Create code to extract and store symbols from fix commits in VulnerableCode[/+]