Update VulnerableCode on AP server PUSH

[pombredanne]

This is a follow up from #15 here for VulnerableCode only:

In a decentralized scenario, there are two or more servers cooperating. Here I would like to start building this multiserver architecture. Specifically, we should build an application to run in a second VulnerableCode server that can receive updates notifications from the FederatedCode ActivityPub server for a package and then fetch the data from the backing git stores. And use this to update this separate VulnerableCode instance, including minimally reconciling conflicts.

• Create script(s) to fetch the backing data from the corresponding FederatedCode backing Git repository and update the local records in VulnerableCode reconciling conflicts as needed #55
• Create the function(s)/services to receive updates notifications from the FederatedCode ActivityPub server in VulnerableCode #56

[ziadhany]

@pombredanne I’ve drawn the whole workflow according to my understanding, relying on data curation based on GitHub.
I have a couple of questions:

1. Should the VulnerableCode instance directly interact with FederatedCode ( get merged review feeds ), or should we just run import/improve from VulnerableCode to get the new curation data from the Git repositories ( vulnerablecode-data) ?

2. For data curation, should we rely on GitHub/GitLab reviews, or should we instead use the FederatedCode review process?

If we use the FederatedCode review process (merge and create review) in FederatedCode, it includes reputation points, so users can vote on reviews or comments.
We could then federate the review feed to the VulnerableCode service if VulnerableCode follows all packages.
or, we could also sync pull requests in github with reviews on FederatedCode.