added openjdk-importer to pipeline - #1635
Conversation
Signed-off-by: Alok Kumar Singh <singhalokkumar960@gmail.com>
|
@keshav-space @pombredanne @ambuj-1211 |
|
Hi @harmonicfunc , When you add a importer pipeline you have to certainly make test_importer with some test data in the |
Signed-off-by: Alok Kumar Singh <singhalokkumar960@gmail.com>
|
the logs for importer run are here: pls review the pr!! |
|
The progress logging looks weird: 769%? Do you know where this is from? |
pombredanne
left a comment
pombredanne
left a comment
There was a problem hiding this comment.
Also, what is this sqlite database about?
https://github.com/aboutcode-org/vulnerablecode/pull/1635/files#diff-3d798ffe81426b5380b70f58d315964762be217077134e5540fda5358ec9848c
This should not be committed
| pipeline_id = "openjdk_importer" | ||
| root_url = "https://openjdk.org/groups/vulnerability/advisories/" | ||
| license_url = "https://openjdk.org/legal/" | ||
| spdx_license_expression = "CC-BY-4.0" |
There was a problem hiding this comment.
Are you sure this is the license? I cannot see anything on the legal page about this.
We should reach out to vuln-report@openjdk.org to ask them about the license of thesei advisories and report here. Or ask at https://mail.openjdk.org/mailman/listinfo/vuln-announce ...
This may be under https://openjdk.org/legal/tou/terms and this may be problematic?
There was a problem hiding this comment.
@seanjmullan @andreasst we are trying to integrate the OpenJDK advisories data in VulnerableCode.
- Would you know what is the license of the advisory data published at https://openjdk.org/groups/vulnerability/advisories/
- Is there a structured data format better suited for data integration than web page scraping that could be available somewhere?
Thanks!
There was a problem hiding this comment.
@seanjmullan @andreasst Sorry for the noise. I meant to tag someone in OpenJDK vulnerability group, not the security group! Would you know someone there who could help?
There was a problem hiding this comment.
sorry for that, will make the changes didnt knew about that, i tried to search for the license but coudnt get it
yeah thats because i took the advisory count from the main page of url:https://openjdk.org/groups/vulnerability/advisories/ , but that might be wrong |
|
@harmonicfunc thanks for your interest. Closing this since it is not ready for merge and has been inactive for long time. Feel free to reopen once the PR is ready. |
4 participants
#1496
revision to previous openjdk-importer with new pr