cravex2-reachability: Extract symbols from vulnerability-fixing patches and commits

[pombredanne]

We need code to extract and store symbols from fix commits in VulnerableCode. This extraction is likely a job for ScanCode. It should leverage the inspectors.

Some data source like the Go advisories already have that data.

See many issues directly about this:

• Already done in the past VCIO-next: Add support to track fix commits: Include commits and patches that fix a vulnerability #207
• Infer Package URL from references and other references issues for "commitish" URLs  #327
• fedcode-next: Improve tracking of fix commits #1695
• fedcode-next: Collect all fix commits #1703
• fedcode-next: Collect existing fix commits and patches open datasets #1697
• Collect fix commits from https://github.com/google/vulncode-db/  #118
• Add data and consider standard from security-patches-dataset and also process this convention #1891
• fedcode-next: Extract unpublished vulnerabilities from commit histories and trackers #1129
• some external https://github.com/s3c2/vfcfinder

Related issues that should likely need to considered together:

• fedcode-next: Code pipeline and models to continuously automatically collect fix commits #1721

[ziadhany]

@pombredanne should this be part of

• cravex2-reachability: Create pipeline for symbol reachability scancode.io#1756

or should I create a new pipeline for this?

[ziadhany]

This is done now, we can extract patch symbols from vulnerability-fixing patches and commits

see:

• Create pipeline for symbol reachability scancode.io#2151