Remove vcs_url and commit_hash from Patch

Remove patch_url from PackageCommitPatch

Signed-off-by: ziad hany <ziadhany2016@gmail.com>

Author: ziadhany

vulnerabilities/importer.py

@@ -202,9 +202,8 @@ def from_url(cls, url):
 @functools.total_ordering
 class PackageCommitPatchData:
     vcs_url: str
-    commit_hash: str
+    commit_hash: Optional[str]
     patch_text: Optional[str] = None
-    patch_url: Optional[str] = None
 
     def __post_init__(self):
         if not self.commit_hash:
@@ -227,7 +226,6 @@ def _cmp_key(self):
             self.vcs_url,
             self.commit_hash,
             self.patch_text,
-            self.patch_url,
         )
 
     def to_dict(self) -> dict:
@@ -236,7 +234,6 @@ def to_dict(self) -> dict:
             "vcs_url": self.vcs_url,
             "commit_hash": self.commit_hash,
             "patch_text": self.patch_text,
-            "patch_url": self.patch_url,
         }
 
     @classmethod
@@ -246,7 +243,6 @@ def from_dict(cls, data: dict):
             vcs_url=data.get("vcs_url"),
             commit_hash=data.get("commit_hash"),
             patch_text=data.get("patch_text"),
-            patch_url=data.get("patch_url"),
         )
 
 
@@ -256,19 +252,11 @@ class PatchData:
     patch_url: Optional[str] = None
     patch_text: Optional[str] = None
     patch_checksum: Optional[str] = dataclasses.field(init=False, default=None)
-    vcs_url: Optional[str] = None
-    commit_hash: Optional[str] = None
 
     def __post_init__(self):
-        if not (self.patch_url or self.patch_text or self.vcs_url):
+        if not (self.patch_url or self.patch_text):
             raise ValueError("A patch must include either patch_url or patch_text or vcs_url")
 
-        if self.vcs_url and not self.commit_hash:
-            raise ValueError("If vcs_url is provided, commit_hash is required")
-
-        if self.commit_hash and not self.vcs_url:
-            raise ValueError("commit_hash requires vcs_url")
-
         if self.patch_text:
             self.patch_checksum = hashlib.sha512(self.patch_text.encode()).hexdigest()
 
@@ -281,8 +269,6 @@ def _cmp_key(self):
         return (
             self.patch_url,
             self.patch_text,
-            self.commit_hash,
-            self.vcs_url,
             self.patch_checksum,
         )
 
@@ -292,17 +278,13 @@ def to_dict(self) -> dict:
             "patch_url": self.patch_url,
             "patch_text": self.patch_text,
             "patch_checksum": self.patch_checksum,
-            "vcs_url": self.vcs_url,
-            "commit_hash": self.commit_hash,
         }
 
     @classmethod
     def from_dict(cls, data: dict):
         """Create a PatchData instance from a dictionary."""
         return cls(
             patch_url=data.get("patch_url"),
-            vcs_url=data.get("vcs_url"),
-            commit_hash=data.get("commit_hash"),
             patch_text=data.get("patch_text"),
         )
 

vulnerabilities/migrations/0107_remove_packagecommitpatch_patch_url_and_more.py

@@ -0,0 +1,25 @@
+# Generated by Django 4.2.25 on 2025-12-01 13:24
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("vulnerabilities", "0106_packagecommitpatch_patch_and_more"),
+    ]
+
+    operations = [
+        migrations.RemoveField(
+            model_name="packagecommitpatch",
+            name="patch_url",
+        ),
+        migrations.RemoveField(
+            model_name="patch",
+            name="commit_hash",
+        ),
+        migrations.RemoveField(
+            model_name="patch",
+            name="vcs_url",
+        ),
+    ]

vulnerabilities/models.py

@@ -2751,20 +2751,6 @@ class Patch(models.Model):
     Used for raw text patches, fallback scenarios, or unsupported VCS types.
     """
 
-    commit_hash = models.CharField(
-        max_length=128,
-        blank=True,
-        null=True,
-        help_text="The commit hash of the patch in the VCS.",
-    )
-
-    vcs_url = models.URLField(
-        max_length=1024,
-        blank=True,
-        null=True,
-        help_text="The Version Control System URL (e.g., git repo URL).",
-    )
-
     patch_url = models.URLField(
         null=True,
         blank=True,
@@ -2782,8 +2768,6 @@ class Patch(models.Model):
         help_text="SHA512 checksum of the patch content.",
     )
 
-    objects = BaseQuerySet.as_manager()
-
     class Meta:
         unique_together = ["patch_checksum", "patch_url"]
 
@@ -2804,7 +2788,6 @@ class PackageCommitPatch(models.Model):
         help_text="The Version Control System URL (e.g., git repo URL).",
     )
 
-    patch_url = models.TextField(blank=True, null=True)
     patch_text = models.TextField(blank=True, null=True)
     patch_checksum = models.CharField(max_length=128, blank=True, null=True)
 

vulnerabilities/pipes/advisory.py

@@ -127,7 +127,6 @@ def get_or_create_advisory_package_commit_patches(
             commit_hash=c.commit_hash,
             vcs_url=c.vcs_url,
             patch_text=getattr(c, "patch_text", None),
-            patch_url=getattr(c, "patch_url", None),
         )
         for c in commit_patches_data
         if (c.commit_hash, c.vcs_url) not in existing_pairs
@@ -158,9 +157,8 @@ def get_or_create_advisory_patches(
     to_create = [
         Patch(
             patch_url=getattr(c, "patch_url", None),
-            patch_text=getattr(c, "patch_checksum", None),
-            commit_hash=getattr(c, "commit_hash", None),
-            vcs_url=getattr(c, "vcs_url", None),
+            patch_text=getattr(c, "patch_text", None),
+            patch_checksum=getattr(c, "patch_checksum", None),
         )
         for c in base_patches_data
         if (c.patch_url, c.patch_checksum) not in existing_pairs
@@ -211,14 +209,11 @@ def classify_patch_source(vcs_url, commit_hash, patch_text, patch_url):
         return base_purl, PackageCommitPatchData(
             vcs_url=final_vcs_url,
             commit_hash=final_commit_hash,
-            patch_url=patch_url,
             patch_text=patch_text,
         )
 
     return None, PatchData(
-        vcs_url=final_vcs_url,
-        commit_hash=final_commit_hash,
-        patch_url=patch_url,
+        patch_url=patch_url or final_vcs_url,
         patch_text=patch_text,
     )
 

vulnerabilities/tests/test_data/aosp/CVE-aosp_test1-expected.json

@@ -8,8 +8,6 @@
     "patches": [
       {
         "patch_url": "https://source.codeaurora.org/quic/la/kernel/msm-5.4/commit/?id=d6876813add62f3cac7c429a41cc8710005d69e8",
-        "vcs_url": null,
-        "commit_hash": null,
         "patch_text": null,
         "patch_checksum": null
       }

vulnerabilities/tests/test_data/aosp/CVE-aosp_test2-expected.json

@@ -8,8 +8,6 @@
     "patches": [
       {
         "patch_url": "https://android.googlesource.com/platform/system/bt/+/6ecbbc093f4383e90cbbf681cd55da1303a8ef94",
-        "vcs_url": null,
-        "commit_hash": null,
         "patch_text": null,
         "patch_checksum": null
       }

vulnerabilities/tests/test_data/aosp/CVE-aosp_test3-expected.json

@@ -20,8 +20,7 @@
           {
             "vcs_url": "https://github.com/torvalds/linux",
             "commit_hash": "0048b4837affd153897ed1222283492070027aa9",
-            "patch_text": null,
-            "patch_url": "https://github.com/torvalds/linux/commit/0048b4837affd153897ed1222283492070027aa9"
+            "patch_text": null
           }
         ]
       }

vulnerabilities/tests/test_data/aosp/CVE-aosp_test4-expected.json

@@ -8,78 +8,56 @@
     "patches": [
       {
         "patch_url": "https://android.googlesource.com/kernel/common/+/c22e479e335628ce8766cfbf06e2ba17e8f9a1bb",
-        "vcs_url": null,
-        "commit_hash": null,
         "patch_text": null,
         "patch_checksum": null
       },
       {
         "patch_url": "https://android.googlesource.com/kernel/common/+/1b627d4e5e61e89b840f77abb3ca6711ad6ffbeb",
-        "vcs_url": null,
-        "commit_hash": null,
         "patch_text": null,
         "patch_checksum": null
       },
       {
         "patch_url": "https://android.googlesource.com/kernel/common/+/4c941665c7368a34b146929b31949555e680a4ee",
-        "vcs_url": null,
-        "commit_hash": null,
         "patch_text": null,
         "patch_checksum": null
       },
       {
         "patch_url": "https://android.googlesource.com/kernel/common/+/758f0dac9104b46016af98304656a0268ac3e105",
-        "vcs_url": null,
-        "commit_hash": null,
         "patch_text": null,
         "patch_checksum": null
       },
       {
         "patch_url": "https://android.googlesource.com/kernel/common/+/44d057a37868a60bc2eb6e7d1dcea701f234d56a",
-        "vcs_url": null,
-        "commit_hash": null,
         "patch_text": null,
         "patch_checksum": null
       },
       {
         "patch_url": "https://android.googlesource.com/kernel/common/+/b9b9f908c8ae82b73b9d75181982028b6bc06c2b",
-        "vcs_url": null,
-        "commit_hash": null,
         "patch_text": null,
         "patch_checksum": null
       },
       {
         "patch_url": "https://android.googlesource.com/kernel/common/+/e068734f9e7344997a61022629b92d142a985ab3",
-        "vcs_url": null,
-        "commit_hash": null,
         "patch_text": null,
         "patch_checksum": null
       },
       {
         "patch_url": "https://android.googlesource.com/kernel/common/+/fdc6c1052bc7d89a5826904fbb4318677e8442ce",
-        "vcs_url": null,
-        "commit_hash": null,
         "patch_text": null,
         "patch_checksum": null
       },
       {
         "patch_url": "https://android.googlesource.com/kernel/common/+/211d59c0034ec9d88690c750ccd6da27f6952dc5",
-        "vcs_url": null,
-        "commit_hash": null,
         "patch_text": null,
         "patch_checksum": null
       },
       {
         "patch_url": "https://android.googlesource.com/kernel/common/+/c9e31d5a4747e9967ace6d05896c78516c4c0850",
-        "vcs_url": null,
-        "commit_hash": null,
         "patch_text": null,
         "patch_checksum": null
       },
       {
         "patch_url": "https://android.googlesource.com/kernel/common/+/e01834bfbafd25fd392bf10014451c4e5f34f829",
-        "vcs_url": null,
-        "commit_hash": null,
         "patch_text": null,
         "patch_checksum": null
       }

vulnerabilities/tests/test_data/aosp/CVE-aosp_test5-expected.json

@@ -8,22 +8,16 @@
     "patches": [
       {
         "patch_url": "https://android.googlesource.com/platform/external/wpa_supplicant_8/+/c66556ca2473620df9751e73eb97ec50a40ffd3e",
-        "vcs_url": null,
-        "commit_hash": null,
         "patch_text": null,
         "patch_checksum": null
       },
       {
         "patch_url": "https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=776f17c87599fae3202e69bb5718ac9062f14695",
-        "vcs_url": null,
-        "commit_hash": null,
         "patch_text": null,
         "patch_checksum": null
       },
       {
         "patch_url": "https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=edb507885fc47cf3cdf061bfba1dc77451a6a332",
-        "vcs_url": null,
-        "commit_hash": null,
         "patch_text": null,
         "patch_checksum": null
       }

vulnerabilities/tests/test_importer.py

@@ -39,7 +39,6 @@ def test_all_importers_have_unique_name():
                     vcs_url="https://github.com/user/repo",
                     commit_hash="a1b2c3d4",
                     patch_text=None,
-                    patch_url="https://github.com/user/repo/commits/a1b2c3d4",
                 ),
             ),
         ),
@@ -52,10 +51,8 @@ def test_all_importers_have_unique_name():
             (
                 None,
                 PatchData(
-                    vcs_url="https://unsupported.example.com/repo",
-                    commit_hash="112233",
                     patch_text=None,
-                    patch_url=None,
+                    patch_url="https://unsupported.example.com/repo",
                 ),
             ),
         ),
@@ -71,7 +68,6 @@ def test_all_importers_have_unique_name():
                     commit_hash="deadbeef",
                     vcs_url="https://github.com/user/repo",
                     patch_text="diff --git a/file b/file",
-                    patch_url="https://github.com/user/repo/commits/a1b2c3d4",
                 ),
             ),
         ),
@@ -86,8 +82,6 @@ def test_all_importers_have_unique_name():
                 PatchData(
                     patch_text="diff content",
                     patch_url="https://example.com/user/unknown/commits/a1b2c3d4",
-                    vcs_url="https://example.com/user/unknown",
-                    commit_hash="a1b2c3d4",
                 ),
             ),
         ),
@@ -115,9 +109,6 @@ def test_all_importers_have_unique_name():
         #         "pkg:github/user/repo",
         #         PackageCommitPatchData(
         #             vcs_url="https://github.com/user/repo",
-        #             commit_hash=None,
-        #             patch_url=None,
-        #             patch_text=None,
         #         ),
         #     ),
         # ),
@@ -132,7 +123,7 @@ def test_all_importers_have_unique_name():
         #         None,
         #         PatchData(
         #             patch_text=None,
-        #             patch_url=None,
+        #             patch_url="https://example.com/user/repo",
         #         ),
         #     ),
         # ),
@@ -147,7 +138,6 @@ def test_all_importers_have_unique_name():
                 PackageCommitPatchData(
                     vcs_url="https://github.com/user/repo",
                     commit_hash="98e516011d6e096e25247b82fc5f196bbeecff10",
-                    patch_url="https://github.com/user/unknown/commit/98e516011d6e096e25247b82fc5f196bbeecff10",
                     patch_text=None,
                 ),
             ),
@@ -188,6 +178,4 @@ def test_classify_patch_source_integration(
     elif isinstance(actual_data_obj, PatchData):
         assert actual_data_obj.patch_url == expected_data_obj.patch_url
         assert actual_data_obj.patch_text == expected_data_obj.patch_text
-        assert actual_data_obj.vcs_url == expected_data_obj.vcs_url
-        assert actual_data_obj.commit_hash == expected_data_obj.commit_hash
         assert actual_purl is None