Add support for parsing Git commit messages

[ziadhany]

I created an initial script to parse Git commit messages that can be easily integrated with our model. The script takes a Git repository as input, parses all commits, and returns the CVEs along with their corresponding fixed commits.

Issues:

• fedcode-next: Extract fix commits from the commit logs in search for CVE-related commit messages #2000
• Extract unpublished vulnerabilities from commit histories and trackers #1129

results:

Found 192 unique CVEs
{
  "CVE-2025-4575": [
    "https://github.com/openssl/openssl/commit/0eb9acc24febb1f3f01f0320cfba9654cf66b0ac",
    "https://github.com/openssl/openssl/commit/e96d22446e633d117e6c9904cb15b4693e956eaa"
  ],
  "CVE-2024-12797": [
    "https://github.com/openssl/openssl/commit/6ae8e947d8e3f3f03eeb7d9ad993e341791900bc",
    "https://github.com/openssl/openssl/commit/798779d43494549b611233f92652f0da5328fbe7",
    "https://github.com/openssl/openssl/commit/87ebd203feffcf92ad5889df92f90bb0ee10a699",
    "https://github.com/openssl/openssl/commit/738d4f9fdeaad57660dcba50a619fafced3fd5e9"
  ],
  "CVE-2024-13176": [
    "https://github.com/openssl/openssl/commit/2af62e74fb59bc469506bc37eb2990ea408d9467",
    "https://github.com/openssl/openssl/commit/07272b05b04836a762b4baa874958af51d513844",
    "https://github.com/openssl/openssl/commit/fcebf0a79a0a69f63721b66e94b01400a7de332e",
    "https://github.com/openssl/openssl/commit/78f6c35b83713d33b263fb85e3727543463d6fd5",
    "https://github.com/openssl/openssl/commit/77c608f4c8857e63e98e66444e2e761c9627916f",
    "https://github.com/openssl/openssl/commit/4b1cb94a734a7d4ec363ac0a215a25c181e11f65",
    "https://github.com/openssl/openssl/commit/392dcb336405a0c94486aa6655057f59fd3a0902",
    "https://github.com/openssl/openssl/commit/3fc4b112da2e2107a65ae2556fb6137098e08801",
    "https://github.com/openssl/openssl/commit/f15294228451217b5e58e2b7f5ad4c7a42303212",
    "https://github.com/openssl/openssl/commit/7d8a8c20e1370e43b0cad17e47a460a6f8e81a34",
    "https://github.com/openssl/openssl/commit/63c40a66c5dc287485705d06122d3a6e74a6a203",
    "https://github.com/openssl/openssl/commit/c3144e102571517df6c15ccc049fa3660ab3cb0a"
  ],

openssl.json

[ziadhany]

This part should not be static

[keshav-space]

Thanks @ziadhany, see some suggestions.

[ziadhany]

This is the list of repositories I think we should collect and parse Git messages from:

• Linux Kernel: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
• BusyBox: https://github.com/mirror/busybox.git
• Nginx: https://github.com/nginx/nginx.git
• Apache Tomcat: https://github.com/apache/tomcat.git
• MySQL Server: https://github.com/mysql/mysql-server.git
• PostgreSQL: https://github.com/postgres/postgres.git
• MongoDB: https://github.com/mongodb/mongo.git
• Redis: https://github.com/redis/redis.git
• SQLite: https://github.com/sqlite/sqlite.git
• PHP: https://github.com/php/php-src.git
• Python (CPython): https://github.com/python/cpython.git
• Ruby: https://github.com/ruby/ruby.git
• Go (Golang): https://github.com/golang/go.git
• Node.js: https://github.com/nodejs/node.git
• Rust: https://github.com/rust-lang/rust.git
• OpenJDK (Java): https://github.com/openjdk/jdk.git
• Swift: https://github.com/swiftlang/swift.git
• OpenSSL: https://github.com/openssl/openssl.git
• Django: https://github.com/django/django.git
• Rails: https://github.com/rails/rails.git
• Laravel: https://github.com/laravel/framework.git
• Spring Framework: https://github.com/spring-projects/spring-framework.git
• React: https://github.com/facebook/react
• Angular: https://github.com/angular/angular
• WordPress: https://github.com/WordPress/WordPress.git
• Docker (Moby): https://github.com/moby/moby.git
• Kubernetes: https://github.com/kubernetes/kubernetes.git
• QEMU: https://gitlab.com/qemu-project/qemu.git
• Xen Project: https://github.com/xen-project/xen.git
• VirtualBox: https://github.com/mirror/vbox.git
• Containerd: https://github.com/containerd/containerd.git
• Ansible: https://github.com/ansible/ansible.git
• Terraform: https://github.com/hashicorp/terraform.git
• Wireshark: https://gitlab.com/wireshark/wireshark.git
• Tcpdump: https://github.com/the-tcpdump-group/tcpdump.git
• Git: https://github.com/git/git.git
• Jenkins: https://github.com/jenkinsci/jenkins.git
• GitLab (Community Edition): https://gitlab.com/gitlab-org/gitlab-foss.git