LH008 sources
Every network request the scripts made through HTTP is in data/read_log.csv with its UTC time, source, endpoint, status and bytes (1,141 rows, 07:17:14 to 07:26:19 UTC on 27 September 2026; data/read_summary.csv totals them by source). Each clone is one row, with the clone's size on disk when it finished. Blobs that git fetched on demand from the blobless clones while files were read at the snapshot and at later commits (07:24 to 07:39:58 UTC) are not logged request by request; the clones held 1.47 GB when made and 1.6 GB on disk at the end, so those fetches came to roughly 0.1 GB. No page of documentation was read. No key, token or credential was used; every read was anonymous.
Local source numbers are L1 to L5; S numbers are the root sources.md.
| id | source | what it gave | observation window of the record | read (UTC, 27 September 2026) |
|---|---|---|---|---|
| L1 | PyPI JSON API, https://pypi.org/pypi/<package>/json and /<version>/json | the release list and first upload time of every version of the 16 projects with a qualifying advisory (data/releases_<library>.csv for the four chosen); for dependents with no repository in Open Source Insights, their project URLs | releases as published; upload times are PyPI's upload_time_iso_8601 of each file, the earliest taken |
07:19:55 to 07:26:19 |
| L2 | Open Source Insights [S11], https://deps.dev/_/s/pypi/p/<library>/v/<version>/dependents and https://api.deps.dev/v3/systems/pypi/packages/<name>/versions/<version> | dependents counts and the listed direct dependents of urllib3 2.6.3 and 2.3.0, cryptography 48.0.0 and 46.0.3, pyjwt 2.12.1 and 2.10.1, starlette 1.0.1 and 0.52.1 (data/frame_counts.csv, data/frame.csv); each screened package's source repository | Open Source Insights' state on the read day; how it chooses the listed sample and resolves each dependent's version was not read | 07:24:16 to 07:26:19 |
| L3 | OSV [S26], https://api.osv.dev/v1/query (by package) and https://api.osv.dev/v1/vulns/<id> | 948 records against the 200 projects (data/osv_advisories.csv), with id, aliases, database_specific.severity, published, modified, github_reviewed_at, nvd_published_at and fixed versions; the affected ranges of the five chosen advisories (data/event_advisory_ranges.csv). GitHub's own advisory pages and API were not read (refused to anonymous requests through this environment in LH007) |
OSV's records as modified to 10 September 2026 (the five chosen) | 07:19:49 to 07:21:38 |
| L4 | ClickPy [S21], ClickHouse's public SQL service (https://sql-clickhouse.clickhouse.com/?user=demo), table pypi.pypi_downloads_per_month |
the 200 projects with most downloads in August 2026 (data/top200.csv) | ClickHouse's copy of PyPI's download log, which it re-ingests when it finds gaps (LH005, sources.md L4) | 07:19:49 |
| L5 | git over HTTPS: blobless clones without checkout of 217 repositories on github.com and gitlab.com (47 attempts, for 35 distinct repositories, refused: the server asked for credentials, which is what GitHub answers for a private, renamed or absent repository) | each repository's default branch; the pin and lock files at the snapshot commit; every first-parent commit after it that touched such a file, to the first move or the head; the moving commit's author, committer, times, parents and message, and for a merge the merged branch tip's | the repositories' histories as served on the read day; git records commit and author times, not when a commit was pushed | clones 07:24:24 to 07:26:19; files and commits read from them to 07:39:58, and read again from the same clones 07:45 to 07:47 (brief.md, amendment 3) |
Earlier Lighthouse records used
- studies/LH007/LH007.md version 0.2, brief.md and scripts/ (the repository rule, clone handling and pin parsing were adapted here), at commit a8a34e5.
- studies/LH002 (the repository rule, through LH007's code), at commit a8a34e5.
From studies/LH008/sources.md in the repository, last changed 27 September 2026.