Re: Historical analysis of pkg-vulnerabilities and remediation timelines

[Thomas Klausner <wiz%gatalith.at@localhost>]

Hi Kamel!

On Tue, Oct 27, 2026 at 04:08:10PM +0100, kamel derouiche wrote:
> Hi,
> I am analyzing vulnerability tracking dynamics and remediation timelines within the pkgsrc ecosystem using the pkg-vulnerabilities database and its commit history. 
> To ensure accurate interpretation of the version control records, I would appreciate guidance on the following points:
> 1- CVS Completeness: Is the complete CVS history of pkgsrc/doc/pkg-vulnerabilities, including older revisions, fully preserved and reliable for historical reconstruction?

The pkg-vulnerabilities file lived, for a long time, in a private CVS
repository. That history is not publicly available.

> 2- Lifecycle Tracking: Can the commit history be used to reliably extract the exact lifecycle of an entry--specifically its initial addition, modifications, and final removal?

Sure.

> 3- Alternative Sources: Are there any legacy sources or local mirrors containing events missing from the public main mirror?

Not public, no.

> 4- Timestamp Semantics: What does a commit timestamp on pkg-vulnerabilities represent operationally? Specifically, how does it correlate with the CVE publication date, triage by the security team, and the actual package patch date?

Usually it's updated after triage and sometimes when a package is fixed with a patch.

> 5- Removal Conventions: Are entries pruned exclusively when a package is fixed, or under other conditions? Can removals be reliably interpreted as remediation events?

We usually do not remove entries from it; some are commented out when
they are reclassified as not-a-vulnerability.

> 6-  Additional Archives: Are there internal logs or secondary datasets mapping these security events more directly?

Not sure what you're looking for here.

Cheers,
 Thomas


> My objective is to cleanly separate the disclosure timeline, the database record timeline, and actual package remediation without misinterpreting database updates.
> Thank you