anchor.diff:  libgpm2,gpm,gpm,gpm,, General Purpose Mouse - shared library,Standard System Utilities,0,0,0,,,
   libgssapi-krb5-2,krb5,kerberos,krb5, https://api.github.com/repos/krb5/krb5/issues, MIT Kerberos runtime libraries - krb5 GSS-API Mechanism,Standard System Utilities,1,0,0,"Vital when using Kerberos; unclear how common that is today. (For Windows, may use SAMBA)",,
   libgssglue1,libgssglue,,libgssglue,, mechanism-switch gssapi library,Standard System Utilities,1,0,0,Vital for systems that use it, amount of use unclear.,https://www.openhub.net/p/perlgssapi Is different from Debian
  +libharfbuzz0b,harfbuzz,harfbuzz,harfbuzz,https://github.com/behdad/harfbuzz/issues,OpenType text shaping engine,libs,0,1,0,,
  +libhyphen0,hyphen,hyphen,hyphen,http://sourceforge.net/p/hunspell/bugs,ALTLinux hyphenation library,libs,0,0,0,,Moved to github but no issues in issue tracker
   libice6,libice,libice,libice,, X11 Inter-Client Exchange library,Standard System Utilities,0,0,0,,,
   libidn11,libidn,libidn,libidn,," GNU Libidn library, implementation of IETF IDN specifications",Standard System Utilities,0,1,0,"Libidn's purpose is to encode and decode internationalized domain names; this data may come straight from attackers (e.g., in web page links, etc.).",Domain names come from external sources in many cases,
   libisc84,bind9,bind,bind9,, ISC Shared Library used by BIND,Standard System Utilities,0,1,0,"Bind9 is critical for security. It does have active development. Part of bind. http://www.isc.org/products/BIND/ Bind has many mailing lists; ""bind-workers"" is in use though with few messages. Bind Has a way to report bugs, but the buglist is intentionally private (so cannot report on it). Uses git, read-only repo is public https://www.isc.org/git/ - active submission by multiple developers. They have a review process https://www.isc.org/git/bind_developer/ ++",,
   libisccc80,bind9,bind,bind9,, Command Channel Library used by BIND,Standard System Utilities,0,1,0,"Bind9 is critical for security. It does have active development. Part of bind. http://www.isc.org/products/BIND/ Bind has many mailing lists; ""bind-workers"" is in use though with few messages. Bind Has a way to report bugs, but the buglist is intentionally private (so cannot report on it). Uses git, read-only repo is public https://www.isc.org/git/ - active submission by multiple developers. They have a review process https://www.isc.org/git/bind_developer/ ++",,
   libisccfg82,bind9,bind,bind9,, Config File Handling Library used by BIND,Standard System Utilities,0,1,0,"Bind9 is critical for security. It does have active development. Part of bind. http://www.isc.org/products/BIND/ Bind has many mailing lists; ""bind-workers"" is in use though with few messages. Bind Has a way to report bugs, but the buglist is intentionally private (so cannot report on it). Uses git, read-only repo is public https://www.isc.org/git/ - active submission by multiple developers. They have a review process https://www.isc.org/git/bind_developer/ ++",,
   libitm1,gcc-4.7,gcc,gcc,, GNU Transactional Memory Library,Standard System Utilities,0,0,0,,,
  +libjemalloc1,jemalloc,jemalloc,jemalloc,https://github.com/jemalloc/jemalloc/issues,General-purpose scalable concurrent malloc(3),libs,0,0,0,,
  +libjpeg62-turbo,libjpeg-turbo,libjpeg-turbo,libjpeg-turbo,https://github.com/libjpeg-turbo/libjpeg-turbo/issues,Libjpeg-turbo JPEG runtime library,libs,0,1,0,,
  +libjpeg8,,libjpeg,libjpeg,, Independent JPEG Group's JPEG runtime library,Web Server,0,1,0,"Widely-used format that is decompressed and provided by attackers. HAS Home Page, Can download as tarball, NO issue tracker, latest version/activity Jan 2014, NO mailing list +++",,
  +libjs-angularjs,angular.js,angularjs,angular.js,https://github.com/angular/angular.js/issues,lets you write client-side web applications as if you had a smarter browser,web,1,1,1,,
  +libjs-bootstrap,twitter-bootstrap3,bootstrap-from-twitter,bootstrap,https://github.com/twitter/bootstrap/issues,"HTML, CSS and JS framework",web,1,1,1,,
  +libjs-codemirror,codemirror-js,CodeMirror,codemirror,https://github.com/codemirror/codemirror/issues,Javascript editor interface for code-like content,web,1,1,1,,
  +libjs-jquery,jquery,jQuery,jquery,https://github.com/jquery/jquery/issues,JavaScript library for dynamic web applications,web,1,1,1,,
  +libjs-lodash,node-lodash,lodash,lodash,https://github.com/lodash/lodash/issues,Lo-dash is a Javascript utility library,web,1,1,1,,
   libk5crypto3,krb5,kerberos,krb5, https://api.github.com/repos/krb5/krb5/issues, MIT Kerberos runtime libraries - Crypto Library,Standard System Utilities,0,1,0,Kerberos.,,
   libkeyutils1,keyutils,keyutils,keyutils, https://api.github.com/repos/pld-linux/keyutils/issues, Linux Key Management Utilities (library),Standard System Utilities,0,1,0,"Manages authorization and encryption keys required to perform secure operations. Public Repo, NO bug tracker, NO mailing list. ++",,
   libklibc,klibc,klibc,klibc,, minimal libc subset for use with initramfs,Standard System Utilities,0,0,0,,,
  
positive.code: tzdata,,,tzdata,, time zone and daylight-saving time data,Standard System Utilities,0,0,0,,,
  ucf,,cfg-update,ucf, https://api.github.com/repos/rich0/cfg-update/issues, Update Configuration File: preserve user changes to config files.,Standard System Utilities,0,0,0,,,
  udev,,udev,udev,, /dev/ and hotplug management daemon,Standard System Utilities,0,0,0,,,
  usbutils,,usbutils,usbutils,https://api.github.com/repos/gregkh/usbutils/issues, Linux USB utilities,Standard System Utilities,0,0,0,,,
  util-linux,,util-linux-ng,util-linux,, Miscellaneous system utilities,Standard System Utilities,0,0,0,,,
  util-linux-locales,util-linux,util-linux-ng,util-linux,, Locales files for util-linux,Standard System Utilities,0,0,0,,,
  vim-common,vim,vim,vim,, Vi IMproved - Common files,Standard System Utilities,0,0,0,,,
  vim-tiny,vim,vim,vim,, Vi IMproved - enhanced vi editor - compact version,Standard System Utilities,0,0,0,,,
  virtualbox-guest-dkms,virtualbox,virtualbox,virtualbox,, x86 virtualization solution - guest addition module source for dkms,Standard System Utilities,0,0,1,,,
  virtualbox-guest-utils,virtualbox,virtualbox,virtualbox,, x86 virtualization solution - non-X11 guest utilities,Standard System Utilities,0,0,1,,,
  virtualbox-guest-x11,virtualbox,virtualbox,virtualbox,, x86 virtualization solution - X11 guest utilities,Standard System Utilities,0,0,1,,,
  virtualbox-ose-guest-x11,virtualbox,virtualbox,virtualbox,, transitional package for virtualbox-guest-x11,Standard System Utilities,0,0,1,,,
  w3m,,w3m,w3m,, WWW browsable pager with excellent tables/frames support,Standard System Utilities,1,0,0,"Web browser, so can clearly process attacker data.  However, less commonly used in practice.",,
  wamerican,scowl,scowl,scowl,, American English dictionary words for /usr/share/dict,Standard System Utilities,0,0,0,,,
  wget,,wget,wget,, retrieves files from the web,Standard System Utilities,1,0,0,"Directly processes potentially-malicious data from the Internet, often used in scripts. GNU project. https://www.gnu.org/software/wget/ Actual development on GNU's Savannah using git and its bugtracker, http://savannah.gnu.org/projects/wget/ Actively developed, many patches. wget-1.16.3 released 2015-03-09 on downloads. Note that this is directly exposed to attack.  It has some code documentation (e.g., http://wget.addictivecode.org/NavigatingTheSource), but it warns that it can be fairly hard to follow, contains a fair number of hacks, and functionality that was ""tacked on"" (which is not good for security). ++",,
  whiptail,newt,newt,newt,, Displays user-friendly dialog boxes from shell scripts,Standard System Utilities,0,0,0,,,
  whois,,,whois,, intelligent WHOIS client,Standard System Utilities,1,0,0,Less commonly used.,Homepage https://github.com/rfc1036/whois,
  x11-common,xorg,x,xorg,, X Window System (X.Org) infrastructure,Standard System Utilities,0,0,1,X development is transitioning towards Wayland.,Typically X isn't directly exposed to arbitrary port connections,
  x11-xkb-utils,,x,xkb,, X11 XKB utilities,Standard System Utilities,0,0,0,,,
  xauth,,,xauth,, X authentication utility,Standard System Utilities,0,0,1,"X Authentication - might enable local privilege escalation.  Home Page: http://www.x.org/ There are current efforts to replace this (e.g., Wayland, Mir). Public code repo is mentioned in dev docs, but clone URL is never stated. Probably given out on request. One nice thing... www.x.org/wiki/Development/Security/ ++",,
  
negative.code: libboost-iostreams1.49.0,boost1.49,,boost,, Boost.Iostreams Library,Standard System Utilities,0,0,0,,,
  libbsd0,libbsd,libbsd,libbsd,, utility functions from BSD systems - shared library,Standard System Utilities,0,0,0,,,
  libbz2-1.0,bzip2,bzip2,bzip2,, high-quality block-sorting file compressor library - runtime,Standard System Utilities,0,1,0,Bzip2 is widely used for decompression of network-supplied data. ++,,
  libc6-dev,eglibc,eglibc,eglibc,, Embedded GNU C Library: Development Libraries and Header Files,Standard System Utilities,0,0,0,,,
  libc6,eglibc,eglibc,eglibc,, Embedded GNU C Library: Shared libraries,Standard System Utilities,0,0,0,,,
  libcap2,,libcap,libcap,, support for getting/setting POSIX.1e capabilities,Standard System Utilities,0,0,1,Implemented by kernel.  Less likely to have issues here.,,
  libc-bin,eglibc,eglibc,eglibc,, Embedded GNU C Library: Binaries,Standard System Utilities,0,0,0,,,
  libc-dev-bin,eglibc,eglibc,eglibc,, Embedded GNU C Library: Development binaries,Standard System Utilities,0,0,0,,,
  libclass-isa-perl,,,libclass,, report the search path for a class's ISA tree,Standard System Utilities,0,0,0,,,
  libcomerr2,e2fsprogs,e2fsprogs,e2fsprogs,, common error description library,Standard System Utilities,0,0,0,,,
  libcwidget3,cwidget,cwidget,cwidget,, high-level terminal interface library for C++ (runtime files),Standard System Utilities,0,0,0,,,
  