Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

SSVC #871

Merged
merged 27 commits into from
Mar 4, 2025
Merged

SSVC #871

merged 27 commits into from
Mar 4, 2025

Conversation

tschmidtb51
Copy link
Contributor

  • addresses parts of Include support for SSVC #803
  • add SSVC decision point value selection 1.0.1 to schema
  • add SSVC decision point value selection 1.0.1 file into referenced schemas
  • adapt test scripts
  • add SSVC link in informative references
  • mention SSVC in design consideration principles
  • add SSVC to metrics section
  • add SSVC to guidance on size
  • add conversion rule
  • add mandatory test 6.1.43 to detect inconsistent SSVC IDs
  • add SSVC schema to testscript for test data
  • add mandatory test 6.1.44 for SSVC
  • add mandatory test 6.1.45 for SSVC Decision Point Namespace
  • add informative test 6.3.13 for Non-Latest SSVC decision point version
  • add optional test 6.2.33 for unknown SSVC namespaces
  • add optional test 6.2.34 for unknown SSVC roles
  • add invalid examples
  • add valid examples

@tschmidtb51
SSVC
68e5ca0 
- addresses parts of oasis-tcs#803
- add SSVC decision point value selection 1.0.1 to schema
- add SSVC decision point value selection 1.0.1 file into referenced schemas
- adapt test scripts
@tschmidtb51
SSVC
4eecfc2 
- addresses parts of oasis-tcs#803
- add SSVC link in informative references
- mention SSVC in design consideration principles
- add SSVC to metrics section
@tschmidtb51
SSVC
a38b394 
- addresses parts of oasis-tcs#803
- update SSVC key in schema to align with CVSS
@tschmidtb51
SSVC
789785c 
- addresses parts of oasis-tcs#803
- update referenced SSVC schema to reflect change from CERTCC/SSVC#654
- reformat JSON schema
@tschmidtb51
SSVC
599b150 
- addresses parts of oasis-tcs#803
- update referenced SSVC schema
@tschmidtb51
SSVC
7ac9c47 
- addresses parts of oasis-tcs#803
- add SSVC to guidance on size
@tschmidtb51
Merge remote-tracking branch 'upstream/editor-revision-2025-02-26' in…
c6889a5 
…to ssvc

- resolve conflict in guidance-on-size.md by correct sorting
@tschmidtb51
SSVC
4d23886 
- addresses parts of oasis-tcs#803
- update link as indicated by CERT/CC
@tschmidtb51
SSVC
4946309 
- addresses parts of oasis-tcs#803
- add conversion rule
@tschmidtb51
SSVC
9762db1 
- addresses parts of oasis-tcs#803
- add mandatory test 6.1.43 to detect inconsistent SSVC IDs
- add invalid examples
- add valid examples
@tschmidtb51
SSVC
1ec5b95 
- addresses parts of oasis-tcs#803
- add SSVC schema to testscript for test data
@tschmidtb51
SSVC
07cfab1 
- addresses parts of oasis-tcs#803
- add mandatory test 6.1.44 for SSVC
- add invalid examples
- add valid examples
@tschmidtb51
SSVC
cd9aabf 
- addresses parts of oasis-tcs#803
- correct that 6.1.43 and 6.1.44 just have a single relevant path, not multiple
@tschmidtb51
SSVC
52f5d9b 
- addresses parts of oasis-tcs#803
- add mandatory test 6.1.45 for SSVC Decision Point Namespace
- add invalid examples
- add valid examples
@tschmidtb51
SSVC
1136122 
- addresses parts of oasis-tcs#803
- add informative test 6.3.13 for Non-Latest SSVC decision point version
- add invalid example
- add valid example
@tschmidtb51
SSVC
95cc120 
- addresses parts of oasis-tcs#803
- add optional test 6.2.33 for unknown SSVC namespaces
- add invalid example
- add valid example
@tschmidtb51
SSVC
946d25e 
- addresses parts of oasis-tcs#803
- improve wording by using registered namespaces instead of reserved
@tschmidtb51
SSVC
7291d49 
- addresses parts of oasis-tcs#803
- add optional test 6.2.34 for unknown SSVC roles
- add invalid example
- add valid example
@tschmidtb51
SSVC
e7f49c8 
- addresses parts of oasis-tcs#803
- update with latest developments from SSVC
@tschmidtb51 tschmidtb51 requested a review from sthagen February 20, 2025 22:48
@tschmidtb51 tschmidtb51 self-assigned this Feb 20, 2025
@tschmidtb51 tschmidtb51 added editor-revision already worked on in the editor revision csaf 2.1 csaf 2.1 work labels Feb 20, 2025
@tschmidtb51
Copy link
Contributor Author

@sei-vsarvepalli Please review (especially the examples)

@tschmidtb51
Copy link
Contributor Author

This is in draft mode as we need to wait for the changes from CERTCC/SSVC#704

sei-vsarvepalli
sei-vsarvepalli reviewed Feb 21, 2025
View reviewed changes
Copy link

@sei-vsarvepalli sei-vsarvepalli left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mostly reviewed and run locally to verify CSAF test with what we hope to produce as well. Will need to look at updating the schema JSON file ./csaf_2.1/referenced_schema/certcc/Decision_Point_Value_Selection-1-0-1.schema.json according to what will be published as non-breaking changes to the schema in https://certcc.github.io/SSVC/data/schema/v1/ location. location.

@tschmidtb51
SSVC
674e64d 
- addresses review comment from oasis-tcs#871
- unify formatting
- sort list lexiographically
@tschmidtb51
Copy link
Contributor Author

tschmidtb51 commented Feb 21, 2025 •
edited
Loading

Open ToDos:

  • Update referenced schemas once they are provided by upstream SSVC
  • Check tests (6.1.45 might be obsolete or need rephrasing)
  • Check test numbering as other PRs might be merge before this
  • add test 6.1.46 Inconsistent SSVC

sthagen
sthagen approved these changes Feb 21, 2025
View reviewed changes
Copy link
Contributor

@sthagen sthagen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM already.

sei-vsarvepalli
sei-vsarvepalli approved these changes Feb 25, 2025
View reviewed changes
Copy link

@sei-vsarvepalli sei-vsarvepalli left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Verified running all the tests and SSVC schema is up to date in our repo https://github.com/CERTCC/SSVC/

@santosomar
Copy link
Contributor

Verified running all the tests and SSVC schema is up to date in our repo https://github.com/CERTCC/SSVC/

This is great! Thank you so much for verifying and testing @sei-vsarvepalli

@tschmidtb51
SSVC
85aefd8 
- addresses parts of oasis-tcs#803
- prepare merge from editor-revision-2025-02-26
- rename tests
- adapt test data
@tschmidtb51
Merge remote-tracking branch 'upstream/editor-revision-2025-02-26' in…
f7fbb1f 
…to ssvc
@tschmidtb51
SSVC
4a421c3 
- addresses parts of oasis-tcs#803
- update referenced schemas for SSVC
@tschmidtb51
SSVC
3d3ad6e 
- addresses parts of oasis-tcs#803
- adapt test 6.1.48 to reflect registered namespaces
- add invalid examples for namespace `cvss`
- add valid examples for namespace `cvss`
@tschmidtb51
SSVC
789e037 
- addresses parts of oasis-tcs#803
- add test 6.1.46 for invalid ssvc
- add invalid examples
- add valid examples
@tschmidtb51
SSVC
8e19dc4 
- addresses parts of oasis-tcs#803
- add test 6.1.49 for inconsistent SSVC timestamp
- add invalid examples
- add valid examples
@tschmidtb51 tschmidtb51 marked this pull request as ready for review March 1, 2025 21:00
@tschmidtb51
Copy link
Contributor Author

@sei-vsarvepalli, @sthagen Please review. I might add an optional test later, if the "private namespace" issue is resolved.

@sei-vsarvepalli
Copy link

Adding a link to the SSVC Issue here - CERTCC/SSVC#703
We may need some time to discuss this, I will be out of the office next week.

sthagen
sthagen approved these changes Mar 4, 2025
View reviewed changes
Copy link
Contributor

@sthagen sthagen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A lot of work, @tschmidtb51, thanks. LGTM.

@tschmidtb51 tschmidtb51 merged commit ac5052f into oasis-tcs:editor-revision-2025-02-26 Mar 4, 2025
5 checks passed
@tschmidtb51
Copy link
Contributor Author

@sei-vsarvepalli Merging now, happy to add the test to the next editor revision 2025-03-26

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@sthagen sthagen sthagen approved these changes

@sei-vsarvepalli sei-vsarvepalli sei-vsarvepalli approved these changes

Assignees

@tschmidtb51 tschmidtb51

Labels
csaf 2.1 csaf 2.1 work editor-revision already worked on in the editor revision
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@tschmidtb51 @santosomar @sei-vsarvepalli @sthagen