swh.vulns 0.2.1

Labeling of objects of the Software Heritage archives with known vulnerabilities affecting them.

Labeling of objects of the Software Heritage archive with known vulnerabilities affecting them.

Deployment

Install dependencies:

1. cargo install --locked swh-graph swh-vulns-grpc-server

2. pip3 install swh.graph

Get data files:

1. Get swh-graph: swh graph download --name 2026-03-02 (~15TB)

2. From s3://softwareheritage/derived_datasets/2026-03-02/vulnerabilities/, download :all.sqlite, :commit2vuln_without_cherrypicks.*, and :connected_components.wccs, about 10GB. (Ignore other files in the directory, they weigh about 1.5TB.)

Run this:

swh-vulns-grpc-serve \
    --db ./2026-03-02/all.sqlite \
    --commit2vuln ./2026-03-02/commit2vuln_without_cherrypicks \
    --subgraphwccs ./2026-03-02/connected_components.wccs \
    --graph ./2026-03-02/graph \
    --bind 127.0.0.1:<port>

note that --commit2vuln and --graph should omit the file extension