Definitely needs more work. The main Go SQLite3 for accessing SQLite databases i...

arp242 · on Dec 11, 2020

That's probably because SQLite doesn't use git, and this tool seems to require git. Actually, in its current state it seems to require GitHub: https://github.com/ossf/criticality_score/blob/main/critical...

This probably omits some other projects as well which don't use git or GitHub.

abharya · on Dec 11, 2020

Yes correct. Right now, we are query-ing projects hosted on Github, but will be expanding to our source control system in the near future.

rhencke · on Dec 11, 2020

Please consider allowing scanning tarball/zip distributions of source directly as well. It is a SCM-agnostic method that is also well-supported by GitHub, Gitiles, hgweb, and many old but still-in-use projects that pre-date Git.

arp242 · on Dec 12, 2020

It would be nice if this could be mentioned a bit clearer in the blog post and/or README; it's not really that obvious at all and I had to go to the source to check, and loads of people here seem confused about it since it more or less implies "we looked at all open source projects".

justinclift · on Dec 11, 2020

No worries. Just to point out though, SQLite does have an official mirror repo on GitHub:

https://github.com/sqlite/sqlite/

jchw · on Dec 11, 2020

That might be because sqlite isn’t on Github.

justinclift · on Dec 11, 2020

Yeah, that could be the case. That being said, lots of projects aren't on GitHub, and SQLite does have a mirror there which is kept up to date:

https://github.com/sqlite/sqlite/

abharya · on Dec 12, 2020

The issue with the mirror is we don't get the important stats to make decisions. E.g. number of contributors, issue changes due to custom issue tracker. We are still thinking on how to add information from such cases in automated fashion, ideas welcome!

justinclift · on Dec 12, 2020

Would it be feasible to add support for Fossil, so it's not just a git-only tool?