Architecture
Traceability
The source data and operations behind a derived vulnerability match.
A match should be inspectable without guessing how it got there. Basilisk keeps the source metadata, identity mapping, matcher version, and operations used to produce it.
What a match records
For a package/advisory match, Basilisk records:
- the source advisory and its metadata,
- the identity mapping used to connect it to a conda-forge package,
- the matcher and matcher version,
- the ingest and reconcile operations.
That gives the API and explorer enough context to show why a match exists and when its inputs were last updated.
Core model
Prop
Type
Every machine write belongs to an operation. For pipeline work, that operation links back to a job run and its source inputs.
Applicability decisions
Human and automated applicability decisions are planned work. They will be append-only: a new decision can supersede an older one, but it will not erase it.