Open pombredanne opened 6 months ago
@pombredanne @TG1999
what ed5
stand for ? ./aboutcode-packages-ed5/maven/org.apache.log4j
@ziadhany re:
what ed5 stand for ? ./aboutcode-packages-ed5/maven/org.apache.log4j
sorry for the late reply, and we discussed it since: this is a hash
@pombredanne yes, we discussed this , and I have updated the pull request #1206 to match the new file structure:
./aboutcode-vulnerabilities-12/34/VCID-1223-3434-34343/VCID-1223-3434-34343.yml
.
However, I'm still concerned about the performance of this script. I believe there's a more efficient method to detect updates on VulnerableCode. At the very least, we should aim to minimize the number of queries in this script.
See the attached zip for a design discussed with @ziadhany and @TG1999 federatedcode-data-structure.zip The approach would be to have separate trees/repos for package metadata and vulnerabilities metadata, and have a cross reference from packages to vulns in packages and the other way in vulnerabilities.
The file tree would be looking more or less this way: