csaf — archive

[Tobias Limmer]

Colleagues, to get an overview of the TC's work and available information, I browsed the public web sites and tried to gather all links. It wasn't easy for me to understand the current state of CSAF, and this is due to quite a lot of different Github repositories and confusing/outdated information in various places. I would hope that it will be easier for other interested parties to get into CSAF more quickly if we clean up the current state. In the following I will show you what I found, and I added some comments and suggestions for improvement to some of the locations. Github: CSAF web site: https://oasis-open.github.io/csaf-documentation/ It is not clear that this web site belongs to CSAF, as the terms CVRF and CSAF are used in a confusing way: The site's title is "CSAF CVRF 1.2" Prominent link to "CVRF 1.2 Spec Doc" Paragraph about "CVRF Adoption" Github project for web site: https://github.com/oasis-open/csaf-documentation/ -> We should clean this site to make clear that the next version will be CSAF 2.0 based on the previous XML-based spec CVRF 1.2 TC's main Github repository: https://github.com/oasis-tcs/csaf Contains major work of TC: the JSON schema and examples Many old artifacts in repository -> This should be cleaned up. Analysis and suggestions are below [1] CSAF parser: https://github.com/oasis-open/csaf-parser What is the current state here? It seems to be only a CVRF parser, as it does not have references to JSON in its code -> Add prominent statement in README of repository to make this clear? External web site: https://github.com/TIBCOSoftware/vulnrep CVRF/CSAF importer/exporter by Eric Google Docs: Draft spec: https://docs.google.com/document/d/1Dk7kslzyX6UDueFXWE4Cz6Erp3oSWuqQ5kHaV_JuApM TODO: https://docs.google.com/document/d/1jB-XH6GX79zfOWtV-QasbNjsD9V91Qjjl1PkX10kCZ0 Please tell me if I missed some places. I propose to talk about my suggestions in the meeting tomorrow! Best regards, Tobi [1] Detailed analysis of the main Github repo: /artifact_linkage Proposal from Stefan Hagen in 2016 to streamline committee work -> Is this still current? Do we need to keep it? /cvrf_1.2 Old CVRF spec /issue_processing Another proposal from Stefan Hagen in 2016 to streamline committee work -> Is this still current? Do we need to keep it? /meeting_minutes Minutes from TC meetings (latest from 10 months ago) /sandbox ./CVRF_repositories.md Contains list of CVRF repositories -> should be moved to /cvrf_1.2 ./csaf_2.0/ -> Contains major work for CSAF 2.0. We should move this directory to the root of the repository ./Cvrf_1_2_errata.md Erratas for CVRF 1.2 -> should be moved to /cvrf_1.2 ./cvrf_1_2_doc_elements.png Some graph from the CVRF spec -> delete? ./json_schema/ ./csaf_json_schema.json Draft JSON schema for CSAF 2.0 ./CVE-2018-0171-modified.json, ./cvrf-rhba-2018-0489-modified.json Examples for CSAF 2.0 -> Move examples to 'examples' directory inside /csaf_2.0, rename them in a consistent way? ./NOTES.md Open issues in the draft Duplicate of https://docs.google.com/document/d/1jB-XH6GX79zfOWtV-QasbNjsD9V91Qjjl1PkX10kCZ0 ? -> Do we want to merge both documents?