Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support multiple purl identifiers in product_identification_helper #781

Merged
merged 1 commit into from
Jan 13, 2025
+99 −28
Merged

Support multiple purl identifiers in product_identification_helper #781

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 14 additions & 7 deletions csaf_2.1/json_schema/csaf_json_schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -247,13 +247,20 @@
"minLength": 1
}
},
"purl": {
"title": "package URL representation",
"description": "The package URL (purl) attribute refers to a method for reliably identifying and locating software packages external to this specification.",
"type": "string",
"format": "uri",
"pattern": "^pkg:[A-Za-z\\.\\-\\+][A-Za-z0-9\\.\\-\\+]*\\/.+",
"minLength": 7
"purls": {
"title": "List of package URLs",
"description": "Contains a list of package URLs (purl).",
"type": "array",
"minItems": 1,
mprpic marked this conversation as resolved.
Show resolved Hide resolved
"uniqueItems": true,
"items": {
"title": "package URL representation",
"description": "The package URL (purl) attribute refers to a method for reliably identifying and locating software packages external to this specification.",
"type": "string",
"format": "uri",
"pattern": "^pkg:[A-Za-z\\.\\-\\+][A-Za-z0-9\\.\\-\\+]*/.+",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mprpic Was there a specific reason why you removed the \\ in front of the /?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm, I think that may have been a suggested edit by my editor, but then I'm not sure why I didn't remove the double-backslashes in the character groups too. In any case, they are unnecessary in all places in this regex if the \\- gets moved to the end of the group, so this is correct as well:

                "pattern": "^pkg:[A-Za-z.+-][A-Za-z0-9.+-]*/.+",

"minLength": 7
}
},
"sbom_urls": {
"title": "List of SBOM URLs",
Expand Down
1 change: 1 addition & 0 deletions csaf_2.1/prose/edit/etc/bind.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,7 @@ tests-01-mndtr-33-multiple-flags-with-vex-justification-codes-per-product.md
tests-01-mndtr-34-branches-recursion-depth.md
tests-01-mndtr-35-contradicting-remediations.md
tests-01-mndtr-36-contradicting-product-status-remediation-combination.md
tests-01-mndtr-38-tests-01-mndtr-38-purl-qualifiers.md
tests-02-optional.md
tests-03-informative.md
distributing.md
Expand Down
2 changes: 1 addition & 1 deletion csaf_2.1/prose/edit/etc/section-display-to-label.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@
"3.1.3.3.1": "full-product-name-type-product-identification-helper-cpe",
"3.1.3.3.2": "full-product-name-type-product-identification-helper-hashes",
"3.1.3.3.3": "full-product-name-type-product-identification-helper-model-numbers",
"3.1.3.3.4": "full-product-name-type-product-identification-helper-purl",
"3.1.3.3.4": "full-product-name-type-product-identification-helper-purls",
"3.1.3.3.5": "full-product-name-type-product-identification-helper-sbom-urls",
"3.1.3.3.6": "full-product-name-type-product-identification-helper-serial-numbers",
"3.1.3.3.7": "full-product-name-type-product-identification-helper-skus",
Expand Down
8 changes: 4 additions & 4 deletions csaf_2.1/prose/edit/etc/section-label-to-display.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,7 +105,7 @@
"full-product-name-type-product-identification-helper-generic-uris": "3.1.3.3.8",
"full-product-name-type-product-identification-helper-hashes": "3.1.3.3.2",
"full-product-name-type-product-identification-helper-model-numbers": "3.1.3.3.3",
"full-product-name-type-product-identification-helper-purl": "3.1.3.3.4",
"full-product-name-type-product-identification-helper-purls": "3.1.3.3.4",
"full-product-name-type-product-identification-helper-sbom-urls": "3.1.3.3.5",
"full-product-name-type-product-identification-helper-serial-numbers": "3.1.3.3.6",
"full-product-name-type-product-identification-helper-skus": "3.1.3.3.7",
Expand Down Expand Up @@ -256,9 +256,9 @@
"vulnerabilities-property-ids": "3.2.4.6",
"vulnerabilities-property-involvements": "3.2.4.7",
"vulnerabilities-property-metrics": "3.2.4.8",
"vulnerabilities-property-metrics-content": "3.2.4.8.1",
"vulnerabilities-property-metrics-products": "3.2.4.8.2",
"vulnerabilities-property-metrics-source": "3.2.4.8.3",
"vulnerabilities-property-metrics-content": "3.2.4.8.1",
"vulnerabilities-property-metrics-products": "3.2.4.8.2",
"vulnerabilities-property-metrics-source": "3.2.4.8.3",
"vulnerabilities-property-notes": "3.2.4.9",
"vulnerabilities-property-product-status": "3.2.4.10",
"vulnerabilities-property-references": "3.2.4.11",
Expand Down
12 changes: 8 additions & 4 deletions csaf_2.1/prose/edit/src/guidance-on-size.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,18 +59,22 @@ An array SHOULD NOT have more than:
* `/product_tree/branches[]/product/product_identification_helper/hashes[]/file_hashes`
* `/product_tree/branches[]/product/product_identification_helper/sbom_urls`
* `/product_tree/branches[]/product/product_identification_helper/x_generic_uris`
* `/product_tree/branches[]/product/product_identification_helper/purls`
* `/product_tree/branches[](/branches[])*/product/product_identification_helper/hashes`
* `/product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes`
* `/product_tree/branches[](/branches[])*/product/product_identification_helper/sbom_urls`
* `/product_tree/branches[](/branches[])*/product/product_identification_helper/x_generic_uris`
* `/product_tree/branches[](/branches[])*/product/product_identification_helper/purls`
* `/product_tree/full_product_names[]/product_identification_helper/hashes`
* `/product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes`
* `/product_tree/full_product_names[]/product_identification_helper/sbom_urls`
* `/product_tree/full_product_names[]/product_identification_helper/x_generic_uris`
* `/product_tree/full_product_names[]/product_identification_helper/purls`
* `/product_tree/relationships[]/full_product_name/product_identification_helper/hashes`
* `/product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes`
* `/product_tree/relationships[]/full_product_name/product_identification_helper/sbom_urls`
* `/product_tree/relationships[]/full_product_name/product_identification_helper/x_generic_uris`
* `/product_tree/relationships[]/full_product_name/product_identification_helper/purls[]`
* `/vulnerabilities[]/acknowledgments`
* `/vulnerabilities[]/acknowledgments[]/names`
* `/vulnerabilities[]/acknowledgments[]/urls`
Expand Down Expand Up @@ -228,14 +232,14 @@ A string SHOULD NOT have a length greater than:
* `/document/references[]/summary`
* `/document/tracking/revision_history[]/summary`
* `/product_tree/branches[]/product/product_identification_helper/cpe`
* `/product_tree/branches[]/product/product_identification_helper/purl`
* `/product_tree/branches[]/product/product_identification_helper/purls[]`
mprpic marked this conversation as resolved.
Show resolved Hide resolved
* `/product_tree/branches[](/branches[])*/product/product_identification_helper/cpe`
* `/product_tree/branches[](/branches[])*/product/product_identification_helper/purl`
* `/product_tree/branches[](/branches[])*/product/product_identification_helper/purls[]`
* `/product_tree/full_product_names[]/product_identification_helper/cpe`
* `/product_tree/full_product_names[]/product_identification_helper/purl`
* `/product_tree/full_product_names[]/product_identification_helper/purls[]`
* `/product_tree/product_groups[]/summary`
* `/product_tree/relationships[]/full_product_name/product_identification_helper/cpe`
* `/product_tree/relationships[]/full_product_name/product_identification_helper/purl`
* `/product_tree/relationships[]/full_product_name/product_identification_helper/purls[]`
* `/vulnerabilities[]/acknowledgments[]/summary`
* `/vulnerabilities[]/involvements[]/summary`
* `/vulnerabilities[]/references[]/summary`
Expand Down
16 changes: 10 additions & 6 deletions csaf_2.1/prose/edit/src/schema-elements-01-defs-03-full-product-name.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ Product ID (`product_id`) holds a value of type Product ID (`product_id_t`).

Helper to identify the product (`product_identification_helper`) of value type `object` provides in its properties at least
one method which aids in identifying the product in an asset database.
Of the given eight properties `cpe`, `hashes`, `model_numbers`, `purl`, `sbom_urls`, `serial_numbers`, `skus`,
Of the given eight properties `cpe`, `hashes`, `model_numbers`, `purls`, `sbom_urls`, `serial_numbers`, `skus`,
and `x_generic_uris`, one is mandatory.

```
Expand All @@ -57,7 +57,7 @@ and `x_generic_uris`, one is mandatory.
"model_numbers": {
// ...
},
"purl": {
"purls": {
// ...
},
"sbom_urls": {
Expand Down Expand Up @@ -240,9 +240,10 @@ Two `*` MUST NOT follow each other.
IC25T060ATCS05-0
```

##### Full Product Name Type - Product Identification Helper - purl
##### Full Product Name Type - Product Identification Helper - purls

The package URL (purl) representation (`purl`) is a `string` of 7 or more characters with `pattern` (regular expression):
List of purls (`purls`) of value type `array` with 1 or more items contains a list of package URL (purl) identifiers.
A purl is a `string` of 7 or more characters that meets the criteria of `pattern` (regular expression):
tschmidtb51 marked this conversation as resolved.
Show resolved Hide resolved

```
^pkg:[A-Za-z\\.\\-\\+][A-Za-z0-9\\.\\-\\+]*\\/.+
Expand All @@ -253,8 +254,11 @@ The package URL (purl) representation (`purl`) is a `string` of 7 or more charac
> CSAF uses only the canonical form of purl to conform with section 3.3 of [cite](#RFC3986).
> Therefore, URLs starting with `pkg://` are considered invalid.

This package URL (purl) attribute refers to a method for reliably identifying and locating software packages external to this specification.
See [cite](#PURL) for details.
A package URL (purl) attribute refers to a method for reliably identifying and locating software packages external to this specification.
See [cite](#PURL) for details. Multiple purls can be specified to allow for identifiers to locate identical components in different locations.

If multiple purls are specified, they SHALL only differ in their qualifiers. Otherwise, separate product branches
should be used to differentiate between the components.

##### Full Product Name Type - Product Identification Helper - SBOM URLs

Expand Down
10 changes: 6 additions & 4 deletions csaf_2.1/prose/edit/src/tests-01-mndtr-13-purl.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,9 @@ It MUST be tested that given purl is valid.
The relevant paths for this test are:

```
/product_tree/branches[](/branches[])*/product/product_identification_helper/purl
/product_tree/full_product_names[]/product_identification_helper/purl
/product_tree/relationships[]/full_product_name/product_identification_helper/purl
/product_tree/branches[](/branches[])*/product/product_identification_helper/purls[]
/product_tree/full_product_names[]/product_identification_helper/purls[]
/product_tree/relationships[]/full_product_name/product_identification_helper/purls[]
```

*Example 1 (which fails the test):*
Expand All @@ -19,7 +19,9 @@ The relevant paths for this test are:
"name": "Product A",
"product_id": "CSAFPID-9080700",
"product_identification_helper": {
"purl": "pkg:maven/@1.3.4"
"purls": [
"pkg:maven/@1.3.4"
]
}
}
]
Expand Down
51 changes: 51 additions & 0 deletions csaf_2.1/prose/edit/src/tests-01-mndtr-38-purl-qualifiers.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,51 @@
### PURL Qualifiers

It MUST be tested that when multiple purls are used in a single `product_identification_helper` object, they only
differ in their qualifiers.

The relevant paths for this test are:

```
/product_tree/branches[](/branches[])*/product/product_identification_helper/purls[]
/product_tree/full_product_names[]/product_identification_helper/purls[]
/product_tree/relationships[]/full_product_name/product_identification_helper/purls[]
```

*Example 1 (which fails the test):*

```
"product_tree": {
"full_product_names": [
{
"name": "Product A",
"product_id": "CSAFPID-9080700",
"product_identification_helper": {
"purls": [
"pkg:maven/org.example.blue/logging@1.3.4",
"pkg:maven/org.example.blue/audit@1.3.4"
]
}
}
]
}
```
> The two purls differ in the name component.

*Example 2 (which passes the test):*

```
"product_tree": {
"full_product_names": [
{
"name": "Product A",
"product_id": "CSAFPID-9080700",
"product_identification_helper": {
"purls": [
"pkg:maven/org.example.blue/logging@1.3.4?repository_url=https://registry.example.org",
"pkg:maven/org.example.blue/logging@1.3.4?repository_url=https://index.example.org"
]
}
}
]
}
```
6 changes: 4 additions & 2 deletions csaf_2.1/test/validator/data/mandatory/oasis_csaf_tc-csaf_2_1-2024-6-1-13-01.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,9 +35,11 @@
"name": "Product A",
"product_id": "CSAFPID-9080700",
"product_identification_helper": {
"purl": "pkg:maven/@1.3.4"
"purls": [
"pkg:maven/@1.3.4"
]
}
}
]
}
}
}
Loading