Support multiple purl identifiers in product_identification_helper #781

mprpic · 2024-08-30T19:01:45Z

This allows a vendor to specify multiple purl identifiers for a single component (present as a product version branch in the product tree). Multiple purls may identify the same component but point to different locations from where that component may be available. Thus, it is mandatory that if multiple purls are present in a single
product_identification_helper object, they must only differ in their qualifiers. Otherwise they should be set up as different product tree branches.

Resolves #774

mprpic · 2024-08-30T19:03:30Z

I'm unsure how to modify the examples to get the final text to build. When I run the make command, I get:

$ make build
bin/volatile.py
detected local reference for acknowledgments-type-example-eg-1 in (The example [eg](#acknowledgments-type-example-eg-1) above SHOULD lead to the following outcome in a human-readable advisory:)
The example \[[1](#acknowledgments-type-example-eg-1)\] above SHOULD lead to the following outcome in a human-readable advisory:
Traceback (most recent call last):
  File "/[...]/csaf/csaf_2.1/prose/edit/bin/volatile.py", line 575, in <module>
    sys.exit(main(sys.argv[1:]))
             ^^^^^^^^^^^^^^^^^^
  File "/[...]/csaf/csaf_2.1/prose/edit/bin/volatile.py", line 461, in main
    global_example_num = eg_global_from[magic_label]
                         ~~~~~~~~~~~~~~^^^^^^^^^^^^^
KeyError: 'purl-eg-2'
make: *** [Makefile:4: build] Error 1

csaf_2.1/prose/edit/src/schema-elements-01-defs-03-full-product-name.md

tschmidtb51 · 2024-09-25T18:15:36Z

@mprpic Thank you for the Draft. I didn't had time yet to do a complete review but here are some quick comments:

The qualifier test should be a separate one. Also, we need to add
- valid examples
- invalid examples
The guidance on size needs to be adapted.
The editorial change should be separate from the feature change (thanks for catching it).
Rebase after Editor revision for TC meeting 2024-08-28 #784 is merged.

mprpic · 2024-10-29T13:31:50Z

* [ ]  The qualifier test should be a separate one. Also, we need to add
  * [ ]  valid examples
  * [ ]  invalid examples

Ack, I can move it to its own section with examples. Do you care if the original one remains as is and a new one is added with the next test number, i.e. tests-01-mndtr-13-purl.md stays as is and a new tests-01-mndtr-35-purl-qualifiers.md is added? Or do I need to sort them next to each other and bump all tests by one?

* [ ]  The guidance on size needs to be adapted.

Done!

* [ ]  The editorial change should be separate from the feature change (thanks for catching it).

So that's any changes to files under csaf_2.1/prose? Are you saying those should go into a separate PR after the schema changes one is merged?

* [ ]  Rebase after [Editor revision for TC meeting 2024-08-28 #784](https://github.com/oasis-tcs/csaf/pull/784) is merged.

Done!

tschmidtb51 · 2024-10-29T23:38:34Z

Ack, I can move it to its own section with examples. Do you care if the original one remains as is and a new one is added with the next test number, i.e. tests-01-mndtr-13-purl.md stays as is and a new tests-01-mndtr-35-purl-qualifiers.md is added? Or do I need to sort them next to each other and bump all tests by one?

Please keep the old file as they were (except for correcting the structure that changed). The new test should be tests-01-mndtr-38-purl-qualifiers.md. (Other ones are already taken.) To add that to the generated document, it must be added in csaf_2.1/prose/edit/etc/bind.txt.

So that's any changes to files under csaf_2.1/prose? Are you saying those should go into a separate PR after the schema changes one is merged?

No. It was specific to the change of brackets (which then resulted in #787).
Note: The suggested change is actually wrong as we are taking about the schema not a specific instance.

tschmidtb51

Please have a look at the suggested changes.

csaf_2.1/json_schema/csaf_json_schema.json

csaf_2.1/prose/edit/src/guidance-on-size.md

tschmidtb51 · 2024-10-29T23:47:19Z

csaf_2.1/prose/edit/src/schema-elements-01-defs-03-full-product-name.md

+List of purls (`purls`) of value type `array` with 1 or more items contains a list of package URL (purl) identifiers.
+A purl is a `string` of 7 or more characters that meets the criteria of `pattern` (regular expression):


Please make sure that aligns with other sections that use an array, e.g. remediations or notes.

Not sure I understand. In what way should the text align with those other sections?

I think it does already (the text translation of the schema constraints into English prose)
... I compared the two text lines (245 and 246 of the new revision) to the notes section introductory prose.

csaf_2.1/prose/edit/src/schema-elements-01-defs-03-full-product-name.md

This allows a vendor to specify multiple purl identifiers for a single component (present as a product version branch in the product tree). Multiple purls may identify the same component but point to different locations from where that component may be available. Thus, it is mandatory that if multiple purls are present in a single product_identification_helper object, they must only differ in their qualifiers. Otherwise they should be set up as different product tree branches.

sthagen

LGTM. But, should we not target the current editorial branch editor-revision-2024-11-27 ?

Please retarget. ... and I will recreate the gap for your new tests-01-mndtr-38-... file to slot in. Thanks.

Update: The merge window for the editor revision of 2024-11-27 will close before this PR can be merged, so I retargeted to a feature branch instead. If approved and merged this change set will become part of the editor revision of December 2024 or later.

mprpic changed the title ~~Support multiple purl identifiers in product_identification_helper~~ Draft: Support multiple purl identifiers in product_identification_helper Aug 30, 2024

mprpic force-pushed the add-multiple-purls branch from abefd8e to 757ee67 Compare August 30, 2024 19:05

tschmidtb51 reviewed Sep 25, 2024

View reviewed changes

csaf_2.1/prose/edit/src/schema-elements-01-defs-03-full-product-name.md Outdated Show resolved Hide resolved

This was referenced Sep 25, 2024

Check code blocks for correct syntax #787

Open

Code block syntax #788

Merged

mprpic force-pushed the add-multiple-purls branch 2 times, most recently from f6e7b8c to ec4efed Compare October 29, 2024 13:31

tschmidtb51 requested changes Oct 29, 2024

View reviewed changes

mprpic force-pushed the add-multiple-purls branch from ec4efed to 7380012 Compare December 3, 2024 19:15

mprpic force-pushed the add-multiple-purls branch from 7380012 to a6888cd Compare December 3, 2024 19:19

mprpic changed the title ~~Draft: Support multiple purl identifiers in product_identification_helper~~ Support multiple purl identifiers in product_identification_helper Dec 3, 2024

sthagen requested changes Dec 3, 2024

View reviewed changes

sthagen changed the base branch from master to add-multiple-purls December 3, 2024 20:52

sthagen approved these changes Dec 3, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support multiple purl identifiers in product_identification_helper #781

Support multiple purl identifiers in product_identification_helper #781

mprpic commented Aug 30, 2024

mprpic commented Aug 30, 2024

tschmidtb51 commented Sep 25, 2024

mprpic commented Oct 29, 2024 •

edited

Loading

tschmidtb51 commented Oct 29, 2024 •

edited

Loading

tschmidtb51 left a comment

tschmidtb51 Oct 29, 2024

mprpic Dec 3, 2024

sthagen Dec 3, 2024 •

edited

Loading

sthagen left a comment •

edited

Loading

		List of purls (`purls`) of value type `array` with 1 or more items contains a list of package URL (purl) identifiers.
		A purl is a `string` of 7 or more characters that meets the criteria of `pattern` (regular expression):

Support multiple purl identifiers in product_identification_helper #781

Are you sure you want to change the base?

Support multiple purl identifiers in product_identification_helper #781

Conversation

mprpic commented Aug 30, 2024

mprpic commented Aug 30, 2024

tschmidtb51 commented Sep 25, 2024

mprpic commented Oct 29, 2024 • edited Loading

tschmidtb51 commented Oct 29, 2024 • edited Loading

tschmidtb51 left a comment

Choose a reason for hiding this comment

tschmidtb51 Oct 29, 2024

Choose a reason for hiding this comment

mprpic Dec 3, 2024

Choose a reason for hiding this comment

sthagen Dec 3, 2024 • edited Loading

Choose a reason for hiding this comment

sthagen left a comment • edited Loading

Choose a reason for hiding this comment

mprpic commented Oct 29, 2024 •

edited

Loading

tschmidtb51 commented Oct 29, 2024 •

edited

Loading

sthagen Dec 3, 2024 •

edited

Loading

sthagen left a comment •

edited

Loading