Skip to content

data-sources.md

Latest commit

 

History

History
32 lines (29 loc) · 4.41 KB

data-sources.md

File metadata and controls

32 lines (29 loc) · 4.41 KB
Raw

Data Sources

Every external source the pipeline consumes, and what each stage takes from it. Details per source live in docs/sources/; counts and coverage live in the preview stats sheet.

Source Value Risk Eligibility
npm downloads, dep tree, package→repo resolution CVE package mapping (via OSV) registry license; funding field; deprecation EOL
pypi downloads, dep tree, project URLs CVE package mapping (via OSV) registry license; funding field; yank EOL
crates downloads, dep tree, repo/homepage URLs CVE package mapping (via OSV) registry license; yank EOL
debian install-count proxy, deps, C/C++ classification — —
homebrew install-count proxy, deps, homepage URLs — SPDX license for cpp; disable!/deprecate! EOL
cpp (derived rollup) blended downloads score, dep tree, PageRank classes Debian package list for OSV queries license join; eol.csv verdicts
github repo identity/validation, stars, mirror_url contributor commits (bus factor/HHI), issue metrics archived flag; license fallback; Sponsors + FUNDING.yml
gitlab repo identity/validation, gl/ repo_id, stars contributor commits, SHA anchors, Scorecard runs archived flag; license fallback
git (local clones) — complexity (LOC, cyclomatic, churn), concentration (bus factor/HHI), workload cadence —
ecosystems eco_crit criticality, repo-URL backfill, maintainers — —
openssf criticality score → openssf_crit Scorecard score → security —
osv — CVE counts per repo (security) —
depsdev — fallback Scorecard; Best Practices badge —
ossfuzz C/C++ whitelist, main_repo URLs fuzzing enrollment (security) —
repology Debian↔Homebrew name unification, upstream URLs — formula lookup for cpp EOL
osi — — OSS-approved license set → oss
endoflife — — product EOL cycles → active
funding (foundation rosters) — — foundation backing → nonprofit, intent
floss-fund — — funding.json manifests → intent
opencollective — — OC presence + budgets → intent, funding score

Two data/sources/ folders are not pipeline inputs: ossinsight/ (legacy cache, no builder reads it) and llms/ (empty — no LLM-generated data enters the pipeline).