Maintaining security in open-source derivative projects (forks) is hindered by low synchronization and the lack of automatic propagation of critical fixes from the original upstream project. Highly divergent forks accumulate independent modifications and indirect vulnerabilities, making patch identification a manual, error-prone, and risky task. This paper proposes a systematic and programmatic framework to track vulnerabilities (CVEs/CWEs), locate their corresponding fixes, and verify their presence or equivalence in forked codebases. The framework integrates automated vulnerability mining with patch similarity analysis and commit-level verification using cryptographic hashes (SHA). Preliminary results confirm that vulnerability metadata alone are often incomplete, requiring direct source-code inspection, which validates the need for a complementary verification mechanism. The expected outcome is a functional prototype and structured reports to support risk mitigation in the open-source software supply chain.
Santos et al. (Thu,) studied this question.
Synapse has enriched 5 closely related papers on similar clinical questions. Consider them for comparative context: