Delete temporary repository data from /tmp after finishing importing a CVE about steady HOT 5 CLOSED

Technically, I agree that it'd be much easier to share the vulnerability information in a format that can be imported straight-forwardly into the database.

Until today, we refrained from doing so because of license concerns. PatchAnalyzer computes the abstract syntax trees of the vulnerable methods, thus, sharing such information essentially corresponds to redistributing the code of the respective open source component.

This is probably Ok with the licenses of most of the projects. However, so far we do not collect license information systematically and do not consider it in our workflows.

from steady.

PatchAnalyzer offers the -d option to delete temporary directories. However, it is not advisable to use it for bulk imports, because many CVEs concern the same source code repository, hence, the expensive cloning would be done over and over again. As such, for bulk imports, we still suggest to manually delete the temporary directories.

In the mid-term, we anyhow plan to rework the sharing and import of vulnerability information such that Steady does not need to wrap Git or other VCS clients any more.

from steady.

As such, for bulk imports, we still suggest to manually delete the temporary directories.

I am using a VM where storage space is limited.

In the mid-term, we anyhow plan to rework the sharing and import of vulnerability information such that Steady does not need to wrap Git or other VCS clients any more.

Yes, now that I am deleting the repository data after importing each CVE, importing is taking a long time (~12 hours and still running). If the patch-analyzer analyzes patch to determine the location of CVEs (I am assuming), isn't it more viable to have the final data ready and import that at once?

Thanks!

from steady.

Thank you so much for taking your time for this clarification!

from steady.

You're very welcome, please close the ticket if you think you're good for the time being.

Cheers, Henrik

from steady.