csaf — archive

OpenVEX at OSSF

From: Feng Cao
To: [email protected]
Date: Wed, 29 Mar 2023 00:08:00 -0000

Dear TC members, We have "relationships" in CSAF (and CVRF), and it can provide the recursive SBOM information. The current limitation is "full_product_name" inside "relationship" doesn't have any vendor information, which implies "full_product_name" should be from the same vendor who publishes CSAF. For example, if Apache Log4j is "default_component_of" Oracle Weblogic Server, there is no way to clarify that "Apache Log4j" isn't a product from Oracle and should be parsed differently. If we agree upon a solution to associate "full_product_name" with the correct vendor, this can greatly enhance CSAF for presenting SBOM. If there is any interest, this can be discussed in tomorrow's call. Thanks --Feng