CVE Record Format Rules

[ccoffin]

Are there any rules or principles that we should define for the CVE Record Format? If appropriate, we can open a separate discussion for the individual ideas.

Some ideas/examples might include:

• The CVE Record Format JSON should NOT be considered a "presentation" format.
• The CVE Record Format should avoid including redundant information wherever possible, e.g., CVSS data currently
• The CVE Record Format input schema should avoid containerized data formats, e.g., Purl

[alilleybrinker]

Just as a point of order, what do you mean by "containerized data formats"?

[ccoffin]

Maybe there is a better word for this, please include and update if you are aware. I think this term was used by someone to describe Purl at one point. The basic idea being that a Purl tries to combine a lot of different pieces of data into a single value. Also applies to CVSS vector strings and CPEs. Should the CVE Record format accept these things on input or should it only accept the discrete parts, and then generate the combined values on output where needed?

[darakian]

I think this term was used by someone to describe Purl at one point. The basic idea being that a Purl tries to combine a lot of different pieces of data into a single value.

That's probably me. Not a formal definition, but purl is one spec with many "types" which I think of as sub-specs as they all have their own rules. By adopting the "containerized data format" purl we implicitly adopt all the sub-specs which are themselves "contained" (unless we explicitly disallow some, see the discussion about disallowing some purl types etc... etc... )

This leads to the state where we could represent the package available at
https://files.pythonhosted.org/packages/c6/af/77b403926025dc6f7fd7b31256394d643469418965eb528eab45d0505358/django-5.2.3.tar.gz
as
pkg:pypi/[email protected]
or as a collection url pypi.org with a lookup key of django and a version of 5.2.3 or maybe the collection url is pythonhosted.org or maybe both work, but I think the idea is clear. One could also imagine a less ambiguous take on the collection url idea 👀

[andrewpollock]

https://github.com/ossf/osv-schema/blob/main/GUIDING_PRINCIPLES.md may be useful for comparison purposes?

[alilleybrinker]

Related, I highly commend anything we can do to be clear about non-goals of the CVE Record Format. Non-goals are fantastic, they help to exclude future possibilities in a way that keeps the project focused and constrains scope.