Replication package for "Foiegras: Source Code Based Software Composition Analysis For C/C++ Applications"

A manually curated ground truth data for C/C++ repositories. Each JSON file represents one repository and documents the libraries it uses, along with their versions and how those versions were identified. Overview This dataset was created by manually analyzing C/C++ repositories to identify the libraries they depend on. For each repository, we examined the codebase at a specific commit and documented: The libraries being used The actual version of each library How the version was determined (version source) Additional comments or notes about the library usage File Structure Each JSON file in this directory corresponds to one repository and follows this structure: { "repoLink": "https://github.com/owner/repo.git", "CommitSha": "abc123def456...", "libs": [ { "Library": "https://github.com/library/name", "Actual_version": "v1.2.3", "Version_Source": "Human readable text on how the version was found", "comment": "Additional information about this entry" } ] } Field Descriptions Top-Level Fields repoLink (string): The URL of the repository under test. This is the repository being analyzed for its dependencies. CommitSha (string): The Git commit hash (SHA) used to curate this ground truth. All library identifications are based on the state of the repository at this specific commit. libs (array): An array of library objects, each representing a dependency identified in the repository. Library Object Fields Each entry in the `libs` array contains: Library (string): The URL or identifier of the library. This can be: A GitHub repository URL (e.g., `https://github.com/user/repo`) An archive URL (e.g., `archive/lua.org/lua`) A source code location identifier Actual_version (string): The version of the library that was identified in the repository. This can be: A semantic version (e.g., `v1.2.3`, `5.3.0`) A branch name (e.g., `master`) A commit hash (e.g., `100f4ff91b5a5b31a84b3999365c3058df6251ea`) A version identifier from the library's own versioning scheme Version_Source (string): Human-readable text describing how the `Actual_version` was determined. This field documents the evidence or method used to identify the version, such as: Links to specific files or lines in the repository References to README files or documentation Commit messages File changes or content matching Folder names Other manual investigation methods comment (string): Additional information or notes about this library entry. This field may contain: Alternative library URLs or sources Notes about custom modifications Clarifications about the library usage Empty string if no additional comments are needed