[windup-dev] Victims Java API, data, features

Hi Jason, (I'm seding 2nd mail to start a new thread, please ignore the previous one.) I have looked closer at Víctims. I have few questions/issues. Could you please help resolving those? Note: I'm adding a PUBLIC mailing list, Windup developers. Feel free to add some Victims list (is there one?) 1) Hashes are not real checksums As someone wrote in https://github.com/victims/victims-cve-db/issues/45 the hashes used by Victims are not just SHA512 hashes of the file content, but something else. I'd like to be able to either find CVE's by a normal file content hash, or create the Victims hash. a) Is there a Java impl? b) Could you add the plain SHA512 (or other, I'm okay with just CRC32) hash to the data? 2) Victims Java client API The Java API doesn't match the needs much. From what I can see, it can a) Sync with the server b) Give me a list of CVE for given SHA512 hash. What I would like to have is: * Have some offline data distributed with our app, provide these data * Search the database by Maven coordinates, classes, * Get a short description of the CVE and date of appearance and how/where it was fixed Is there a plan for extending the Java API? Also I guess not all these are covered in the Victims database, right? 3) Configuration The configuration is done through system properties, that's not too fortunate. For instance it doesn't allow to run multiple clients at once in the same JVM. Could that be done through an API? 4) Data structure The data structure of the JSON is not obvious. Is there some docs for it? 5) Data storage The data are only stored in a database over JDBC. Could it be simply stored in a JSON or XML file? The file is just 165 KB and not growing too fast, so I think rather than bringing an embedded DB as a dependency, I'd prefer to process a XML file into a HashMap or a Lucene index and use that. Thanks, Ondra On 4.4.2016 02:16, Jason Shepherd wrote: