aboutcode-org / aboutcode-org/dejacode

Enhancement request: a default purpose and default deployed on Packages

Aberta
#191 0 comentários 0 reações 0 responsáveis Ver no GitHub
design needed enhancement PackageSet
Linguagem predominante
Python
Estrelas
50
Forks
27
Merge médio
4h 51min
PRs com merge (30d)
11

Descrição

When doing vulnerability management, it would be useful to track a global, dataspace Package a default purpose and default deployment.

This is an important context item for vulnerability mitigation prioritization.

- For instance, the Python sphinx doc tool is a "tool" by default.
- Junit is for tests in Java by default, and not deployed by default.

Given a vulnerability that affects a package, its default deployment and default purpose matters as this context should lower the actual risk exposure for this vulnerability. This could be an important part of a policy. The same data could be further set at the product-package level and would override the global dataspace- or purldb-level attributes.

These data items could be fed from PurlDB, some can be inferred, a lot would be curated.

Guia de contribuição

Abrir o guia de contribuição

Avaliação

Esta issue ainda não foi avaliada.

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.