Generic Software Identification Parameter/Attribute to be included in CSAF 2.0 schema.

["Omar Santos (osantos)" <osantos@cisco.com>]

This is to continue the discussion related to a Generic Software Identification Parameter/Attribute to be included in CSAF 2.0 schema.

The following is the current CSAF 2.0 draft schema:

https://github.com/oasis-tcs/csaf/blob/master/sandbox/csaf_2.0/json_schema/csaf_json_schema.json

Under full_product_name there is a CPE property. Replacing CPE for âstandard_product_identifierâ (or similar) may be the best place. Then the $ref: could be to a pointer to a SWID, CO-SWID, SPDX, etc docâ Thoughts or suggestions?

"full_product_name_t": {
	"type": "object",
	"required": [
	"product_id",
	"text"
	],
	"properties": {
	"product_id": {
	"$ref": "#/definitions/non_empty_string_t"
	},
	"text": {
	"$ref": "#/definitions/non_empty_string_t"
	},
	"cpe": {
	"$ref": "#/definitions/non_empty_string_t"
	}
	}
	},
	"non_empty_string_t": {
	"type": "string",
	"minLength": 1
	},