Repository navigation
A whole-tree scan that drops a file is an error, no longer a clean verdict. Handed a directory, spatch skips any file it raised on, prints EXN: <exception> in <file> and still exits 0, which read as "not vulnerable" for a file never scanned; only timeouts were caught. SpatchTruncated ("error": "truncated" in reports) names the files and the exceptions. A torn AST-cache entry, the cause seen in practice, is evicted and the scan rerun once without the cache.
A scan of named files that dies on a torn AST-cache entry is rerun once without the cache, after evicting the entries of every file it was given; stock spatch exits non-zero there without naming the file, which used to fail the CVE on every run until --cache-clear.
sympy is no longer a dependency, which saves 47 MB installed and an import in every pool worker. --kernel-config used it only to evaluate and print Kbuild conditions; a small parser for that grammar (CONFIG symbols, &, |, ~, parentheses) now does both. No verdict changes; a few logic strings in reports come out shorter.
The project moved to github.com/linux-analysis/cvehound, and cvehound-spatch with it.
Full Changelog: 1.7.0...1.8.0