ossf / ossf/osv-schema

Machine readable encoding for configurations

Open
#281 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

discussion
Dominant language
Go
Stars
271
Forks
129
Avg merge
3h 46m
Merged PRs (30d)
4

Description

For example, some vulnerabilities may only be relevant on certain operating systems / architectures. Are there other similar information that can be encoded in a machine readable and actionable way?

This issue tracks adding this as a potential new field to affected. e.g. something like:

{
	"affected": [ {
                 ....
		"configurations": [
                   {"os": "Windows"},
                   {"arch": "x86-64"},
                 ]
	} ]
}

This glosses over some additional detail (e.g. do we need to express specific versions of OSes?)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The issue names the affected field and proposes a JSON configurations field, but no files or tests. Start by reviewing the current affected schema and its examples; done means agreeing on how operating systems, architectures, and possible OS versions are represented and updating the schema accordingly.

Written by the indexing model from the issue text.

Assessment

Tech stack
json
Domain
security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.