tests fixes and sprints work

2026-01-22 19:08:46 +02:00
parent c32fff8f86
commit 726d70dc7f
881 changed files with 134434 additions and 6228 deletions
--- a/datasets/golden-corpus/seed/manifest.json
+++ b/datasets/golden-corpus/seed/manifest.json
@@ -0,0 +1,144 @@
+{
+  "manifestVersion": "1.0.0",
+  "corpusId": "golden-corpus-seed-v1",
+  "createdAt": "2026-01-21T00:00:00Z",
+  "description": "Golden corpus seed list for patch-paired artifact validation",
+  "selectionCriteria": {
+    "primaryAdvisory": true,
+    "patchPairedAvailable": true,
+    "permissiveLicense": true,
+    "reproducibleBuild": "preferred"
+  },
+  "targets": [
+    {
+      "id": "debian-zlib-DSA-5218-1",
+      "package": "zlib1g",
+      "distro": "debian",
+      "advisory": "DSA-5218-1",
+      "cves": ["CVE-2022-37434"],
+      "vulnerableVersion": "1:1.2.11.dfsg-2+deb11u1",
+      "fixedVersion": "1:1.2.11.dfsg-2+deb11u2",
+      "license": "zlib",
+      "licenseVerified": true,
+      "status": "verified"
+    },
+    {
+      "id": "debian-curl-DSA-5587-1",
+      "package": "curl",
+      "distro": "debian",
+      "advisory": "DSA-5587-1",
+      "cves": ["CVE-2023-46218", "CVE-2023-46219"],
+      "vulnerableVersion": "7.88.1-10+deb12u4",
+      "fixedVersion": "7.88.1-10+deb12u5",
+      "license": "curl",
+      "licenseVerified": true,
+      "status": "verified"
+    },
+    {
+      "id": "debian-libxml2-DSA-5391-1",
+      "package": "libxml2",
+      "distro": "debian",
+      "advisory": "DSA-5391-1",
+      "cves": ["CVE-2023-28484", "CVE-2023-29469"],
+      "vulnerableVersion": "2.9.14+dfsg-1.2",
+      "fixedVersion": "2.9.14+dfsg-1.3~deb12u1",
+      "license": "MIT",
+      "licenseVerified": true,
+      "status": "verified"
+    },
+    {
+      "id": "debian-openssl-DSA-5532-1",
+      "package": "openssl",
+      "distro": "debian",
+      "advisory": "DSA-5532-1",
+      "cves": ["CVE-2023-5363"],
+      "vulnerableVersion": "3.0.11-1~deb12u1",
+      "fixedVersion": "3.0.11-1~deb12u2",
+      "license": "Apache-2.0",
+      "licenseVerified": true,
+      "status": "verified"
+    },
+    {
+      "id": "debian-sqlite3-DSA-5466-1",
+      "package": "sqlite3",
+      "distro": "debian",
+      "advisory": "DSA-5466-1",
+      "cves": ["CVE-2023-7104"],
+      "vulnerableVersion": "3.40.1-1",
+      "fixedVersion": "3.40.1-2",
+      "license": "Public Domain",
+      "licenseVerified": true,
+      "status": "verified"
+    },
+    {
+      "id": "debian-expat-DSA-5085-1",
+      "package": "expat",
+      "distro": "debian",
+      "advisory": "DSA-5085-1",
+      "cves": ["CVE-2022-25235", "CVE-2022-25236", "CVE-2022-25313", "CVE-2022-25314", "CVE-2022-25315"],
+      "vulnerableVersion": "2.4.1-3",
+      "fixedVersion": "2.4.1-3+deb11u1",
+      "license": "MIT",
+      "licenseVerified": true,
+      "status": "verified"
+    },
+    {
+      "id": "debian-tiff-DSA-5361-1",
+      "package": "tiff",
+      "distro": "debian",
+      "advisory": "DSA-5361-1",
+      "cves": ["CVE-2022-48281"],
+      "vulnerableVersion": "4.5.0-5",
+      "fixedVersion": "4.5.0-6",
+      "license": "libtiff",
+      "licenseVerified": true,
+      "status": "verified"
+    },
+    {
+      "id": "debian-libpng1.6-DSA-5607-1",
+      "package": "libpng1.6",
+      "distro": "debian",
+      "advisory": "DSA-5607-1",
+      "cves": ["CVE-2024-25062"],
+      "vulnerableVersion": "1.6.39-2",
+      "fixedVersion": "1.6.39-2+deb12u1",
+      "license": "libpng",
+      "licenseVerified": true,
+      "status": "pending-verification"
+    },
+    {
+      "id": "alpine-busybox-CVE-2022-28391",
+      "package": "busybox",
+      "distro": "alpine",
+      "advisory": "secdb main/busybox",
+      "cves": ["CVE-2022-28391"],
+      "vulnerableVersion": "1.35.0-r13",
+      "fixedVersion": "1.35.0-r14",
+      "license": "GPL-2.0",
+      "licenseVerified": false,
+      "status": "license-review-required",
+      "notes": "GPL license requires separate handling for redistribution"
+    },
+    {
+      "id": "alpine-apk-tools-CVE-2021-36159",
+      "package": "apk-tools",
+      "distro": "alpine",
+      "advisory": "secdb main/apk-tools",
+      "cves": ["CVE-2021-36159"],
+      "vulnerableVersion": "2.12.6-r0",
+      "fixedVersion": "2.12.7-r0",
+      "license": "GPL-2.0",
+      "licenseVerified": false,
+      "status": "license-review-required",
+      "notes": "GPL license requires separate handling for redistribution"
+    }
+  ],
+  "statistics": {
+    "totalTargets": 10,
+    "debianTargets": 8,
+    "alpineTargets": 2,
+    "verifiedLicenses": 7,
+    "pendingLicenseReview": 2,
+    "totalCves": 15
+  }
+}