Clearly state hardware/software separation in product_tree
#817
Assignees
Labels
Comments
tschmidtb51
added a commit
to tschmidtb51/csaf
that referenced
this issue
Jan 16, 2025
- addresses parts of oasis-tcs#817 - add section about hardware/software separation with example - add full describe rule
Merged
tschmidtb51
added a commit
to tschmidtb51/csaf
that referenced
this issue
Jan 16, 2025
- addresses parts of oasis-tcs#817 - add optional test to detect potential mixing of hard- and software (6.2.31) - add invalid example - add valid examples
tschmidtb51
added a commit
to tschmidtb51/csaf
that referenced
this issue
Jan 16, 2025
- addresses parts of oasis-tcs#817 - clarify the informative note about test failure
tschmidtb51
added a commit
to tschmidtb51/csaf
that referenced
this issue
Jan 23, 2025
- addresses parts of oasis-tcs#817 - add optional test to detect multiple same PIH (6.2.32) - add invalid examples - add valid examples
tschmidtb51
added a commit
to tschmidtb51/csaf
that referenced
this issue
Jan 23, 2025
- addresses parts of oasis-tcs#817 - add invalid example - update testcases
tschmidtb51
added a commit
to tschmidtb51/csaf
that referenced
this issue
Jan 23, 2025
- addresses parts of oasis-tcs#817 - update testcase schema to add new test 6.2.32
tschmidtb51
added a commit
to tschmidtb51/csaf
that referenced
this issue
Jan 31, 2025
- addresses parts of oasis-tcs#841, oasis-tcs#817, oasis-tcs#629 - clearly state that additional conventions have to be respected by the consumer
sthagen
added a commit
that referenced
this issue
Feb 14, 2025
* Support multiple purl identifiers in product_identification_helper This allows a vendor to specify multiple purl identifiers for a single component (present as a product version branch in the product tree). Multiple purls may identify the same component but point to different locations from where that component may be available. Thus, it is mandatory that if multiple purls are present in a single product_identification_helper object, they must only differ in their qualifiers. Otherwise they should be set up as different product tree branches. * PURLs - addresses parts of #774 - assign new test number based on current master branch * PURLs - addresses parts of #774, #781, #693 - add `\\` to mask `/` (based on discussion in #693) * PURLs - addresses parts of #774, #781 - adapt prose to meet writing style and align with schema * PURLs - addresses parts of #774, #781 - sort list entries * PURLs - addresses parts of #774, #781, #341 - improve wording - add valid example * PURLs - addresses parts of #774, #781, #341 - improve wording of 6.1.42 - move tests to testfiles - add invalid examples - add valid examples - adapt test schema * Test 6.1.13 - addresses parts of #774, #781, #341 - add valid example - add invalid example for oci case (not namespace allowed) * Fixed nits in participants table - names and affiliations should match roster - sorted lines * Seed Editor revision 2025-01-29 - update dates - insert new revision for tracking * ROLIE update - addresses parts of #677 - add `last_updated` ROLIE section in PMD schema * ROLIE update - addresses parts of #677 - adapt examples to reflect change * Hardware and Software - addresses parts of #817 - add section about hardware/software separation with example - add full describe rule * Nit: incomplete word * Hardware and Software - addresses parts of #817 - add optional test to detect potential mixing of hard- and software (6.2.31) - add invalid example - add valid examples * Hardware and Software - addresses parts of #817 - clarify the informative note about test failure * Hardware and Software - addresses parts of review comment of #857 - state linking in vulnerability section as example * Hardware and Software - addresses parts of review comment of #857 - soften statement and link to CVE statistics * Hardware and Software - addresses parts of review comment of #857 - remove "prohibited" from informative paragraph * Update csaf_2.1/prose/edit/src/schema-elements-01-defs-03-full-product-name.md Co-authored-by: tschmidtb51 <[email protected]> * Candidate rewording of informative text Feel free to revert ... * Hardware and Software - addresses parts of #817 - add optional test to detect multiple same PIH (6.2.32) - add invalid examples - add valid examples * Hardware and Software - addresses parts of review comment of #857 - remove merge artifact - clarify text regarding matching * Hardware and Software - addresses parts of #817 - add invalid example - update testcases * Hardware and Software - addresses parts of #817 - update testcase schema to add new test 6.2.32 * Editorial - addresses parts of #841 - correct vers example by removing invalid space * Editorial - addresses parts of #841 - update link to vers * Editorial - addresses parts of #841 - update count of conformance targets * Editorial - addresses parts of #841 - fix refs in date and time (wrong brackets) * Editorial - addresses parts of #841 - fix format mistake - add section 5 to be of relevance for conformance * Editorial - addresses parts of #841 - sort guidance on size - remove obsolete scores from guidance on size * Editorial - addresses parts of #841 - update OpenSSL digest list * Editorial - addresses parts of #841 - update reference to ISO 8601 * Editorial - addresses parts of #841 - update SBOM format references * CWEs - addresses parts of #530, #841 - rephrase test 6.1.11 and 6.3.4 to clarify the test according to the change to multiple CWEs * PURLs - addresses parts of #774, #841 - add conversion rule - correct JSON path by adding missing `product_identification_helper` part * Editorial - addresses parts of #841 - update missing dates - update CVE link * Editorial - addresses parts of #841, #817, #629 - clearly state that additional conventions have to be respected by the consumer * Suggested edit of CVE reference * Added missing section entries * Amended example and section label mappings * Rendered user facing delivery items --------- Signed-off-by: Stefan Hagen <[email protected]> Co-authored-by: Martin Prpič <[email protected]> Co-authored-by: Stefan Hagen <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Currently, the requirement to separate hardware and software in the
product_treeis hidden in the PIH. We should make that more visible by adding a section to chapter 5.The text was updated successfully, but these errors were encountered: