Hi,
I am analyzing vulnerability tracking dynamics and remediation timelines within the pkgsrc ecosystem using the pkg-vulnerabilities database and its commit history.
To ensure accurate interpretation of the version control records, I would appreciate guidance on the following points:
1- CVS Completeness: Is the complete CVS history of pkgsrc/doc/pkg-vulnerabilities, including older revisions, fully preserved and reliable for historical reconstruction?
2- Lifecycle Tracking: Can the commit history be used to reliably extract the exact lifecycle of an entry--specifically its initial addition, modifications, and final removal?
3- Alternative Sources: Are there any legacy sources or local mirrors containing events missing from the public main mirror?
4- Timestamp Semantics: What does a commit timestamp on pkg-vulnerabilities represent operationally? Specifically, how does it correlate with the CVE publication date, triage by the security team, and the actual package patch date?
5- Removal Conventions: Are entries pruned exclusively when a package is fixed, or under other conditions? Can removals be reliably interpreted as remediation events?
6- Additional Archives: Are there internal logs or secondary datasets mapping these security events more directly?
My objective is to cleanly separate the disclosure timeline, the database record timeline, and actual package remediation without misinterpreting database updates.
Thank you