Generic Software Identification Parameter/Attribute to be included in CSAF 2.0 schema.

This is to continue the discussion related to a Generic Software Identification Parameter/Attribute to be included in CSAF 2.0 schema.

The following is the current CSAF 2.0 draft schema:

https://github.com/oasis-tcs/csaf/blob/master/sandbox/csaf_2.0/json_schema/csaf_json_schema.json

Under full_product_name there is a CPE property. Replacing CPE for âstandard_product_identifierâ (or similar) may be the best place. Then the $ref: could be to a pointer to a SWID, CO-SWID, SPDX, etc docâ Thoughts or suggestions?

"full_product_name_t": {

"type":
"object",

"required": [

"product_id",

"text"

],

"properties": {

"product_id": {

"$ref":
"#/definitions/non_empty_string_t"

},

"text": {

"$ref":
"#/definitions/non_empty_string_t"

},

"cpe": {

"$ref":
"#/definitions/non_empty_string_t"

}

}

},

"non_empty_string_t": {

"type":
"string",

"minLength":
1

},