Re: [csaf] CSAF JSON Schema - what to do about product statuses?

[Allan Thomson <athomson@lookingglasscyber.com>]

Agree with your suggestion.

 

Allan

From: <csaf@lists.oasis-open.org> on behalf of Eric Johnson <eric@tibco.com>
Date: Wednesday, May 2, 2018 at 4:59 PM
To: "csaf@lists.oasis-open.org" <csaf@lists.oasis-open.org>
Subject: [csaf] CSAF JSON Schema - what to do about product statuses?

 

In XML, a snippet of the document looks like this:

 

    <ProductStatuses>

      <Status Type="Known Affected">

        <ProductID>CVRFPID-103559</ProductID>

        <ProductID>CVRFPID-103763</ProductID>

...

 

The status can be one of several fixed choices "Fixed", "Known Affected", 

A straightforward translation to JSON turns this into:

"product_statuses": [

  {

    "status_type": "known affected",

    "product_ids": ["CVRFPID-103559", "CVRFPID-103763",

...

I think a slightly more elegant form for the world of JSON looks more like this:

"product_status" : {

  "fixed": [],

  "first_affected": [],

  "known_affected": [],

  "known_not_affected": [],

  "first_fixed": [],

  "recommended": [],

  "last_affected": []

}

 

The concrete example from above becomes:

 

"product_status": {

  "known_affected": ["CVRFPID-103559", "CVRFPID-103763", ...

},

 

Thoughts, comments?

 

Eric.