Hacker News new | ask | show | jobs
by arp242 2023 days ago
That's probably because SQLite doesn't use git, and this tool seems to require git. Actually, in its current state it seems to require GitHub: https://github.com/ossf/criticality_score/blob/main/critical...

This probably omits some other projects as well which don't use git or GitHub.
1 comments
abharya 2023 days ago
Yes correct. Right now, we are query-ing projects hosted on Github, but will be expanding to our source control system in the near future.
link
rhencke 2023 days ago
Please consider allowing scanning tarball/zip distributions of source directly as well. It is a SCM-agnostic method that is also well-supported by GitHub, Gitiles, hgweb, and many old but still-in-use projects that pre-date Git.
link
arp242 2022 days ago
It would be nice if this could be mentioned a bit clearer in the blog post and/or README; it's not really that obvious at all and I had to go to the source to check, and loads of people here seem confused about it since it more or less implies "we looked at all open source projects".
link
justinclift 2022 days ago
No worries. Just to point out though, SQLite does have an official mirror repo on GitHub:

https://github.com/sqlite/sqlite/

link