Traceability
The source data and operations behind a derived vulnerability match.
A match should be inspectable without guessing how it got there. Basilisk keeps the source metadata, identity mapping, matcher version, and operations used to produce it.
What a match records
For a package/advisory match, Basilisk records:
- the source advisory and its metadata,
- the identity mapping used to connect it to a conda-forge package,
- the matcher and matcher version,
- the ingest and reconcile operations.
- any applicability enrichment provider, immutable source link, revision, and content hash.
That gives the API and explorer enough context to show why a match exists and when its inputs were last updated.
Core model
Prop
Type
Every machine write belongs to an operation. For pipeline work, that operation links back to a job run and its source inputs.
NVD remains the advisory source when Anchore supplies its CPE applicability. Original and effective applicability states are exposed separately. Evaluated evidence retains the enrichment revision used even after a later replacement or removal; current source status does not rewrite that historical attribution.
Applicability decisions
Human and automated applicability decisions are planned work. They will be append-only: a new decision can supersede an older one, but it will not erase it.