marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 03:49:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

bench(independent): OpenCVE case licence checked (BUSL-1.1); published by maintainer decision

Browse Source 
Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
Marius Ciepluch
2026-10-02 09:12:22 +02:00
co-authored by Claude Fable 5.1
parent f0110f4429
commit 285b6a367f
2 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
benchmarks/independent/population-v1.toml
+1 -1
View File
@@ -184,6 +184,6 @@ vulnerable = "928bbadbb1672051bcfc2a6289a9e6a8f029c106"
fixed = "0af7f894debc95c67fa53e7ba5a6cdecb10c34f0"
sink = "web/projects/notifications.py :: _http_post_json (webhook and Slack test POST to a user-supplied URL)"
privilege = "authenticated (can configure project notifications)"
license = "unverified (GitHub reports NOASSERTION; possibly non-OSS BSL) -- verify before publishing any result"
license = "BUSL-1.1 (verified 2026-10-02: github.com/opencve/opencve LICENSE -- Business Source License 1.1, not OSI; non-production use permitted by the Additional Use Grant; change date 2030-08-14 to Apache-2.0). Published by maintainer decision 2026-10-02: the record holds metadata only (repository, pins, detection), no OpenCVE code."
notes = "Selected by the maintainer despite the licence question; results must not be redistributed until it is checked."
benign = { base = "0c8101082ba20628b28fcec9c4611745d32202c2", tip = "965dc348e225308edabdfef3ecb76f7d73a0c162", subject = "fix: unlink automation executions before cleaning expired reports" }
benchmarks/independent/protocol-v1.md
+3 -1
View File
@@ -58,4 +58,6 @@ and zero fixed or benign false alerts. A gate that is not met is reported as not
- No rule, fact, query or scoring change informed by these results before the result is committed.
- Any change made after it is a retune. A retune can only be qualified on a NEW untouched population, as
release-milestones M4 requires.
- The OpenCVE case is not published until its licence is checked.
- The OpenCVE case is not published until its licence is checked. Checked 2026-10-02: BUSL-1.1 (not OSI; non-production
use permitted; converts to Apache-2.0 on 2030-08-14). The maintainer decided to publish the case record, which holds
metadata only (repository, pins, detection) and no OpenCVE code.