ROLIE feed schema

[tschmidtb51]

• addresses parts of JSON schema for ROLIE feed #480
• draft first JSON schema for ROLIE feeds
• update timestamps of example to conform format "date-time"
• add test for ROLIE feed schema
• integrate into GitHub actions

[tschmidtb51]

@bernhardreiter Just a first draft that needs refinement...

[santosomar]

WOW! This is amazing! Great work on this. The ROLIE RFC mentions the support for pagination:

   o  "first" - Indicates that the "href" attribute value of the link
      identifies a resource URI for the furthest preceding page of
      the Feed.

   o  "last" - Indicates that the "href" attribute value of the link
      identifies a resource URI for the furthest following page of
      the Feed.

   o  "previous" - Indicates that the "href" attribute value of the link
      identifies a resource URI for the immediately preceding page of
      the Feed.

   o  "next" - Indicates that the "href" attribute value of the link
      identifies a resource URI for the immediately following page of
      the Feed.

We probably don't have to edit the CSAF ROLIE schema, but probably we can mention it in the documentation? If a ROLIE feed has pagination, will it fail validation of this schema?

[santosomar]

Since pagination could be a problem (probably?), we may need to think about it and document this... The JSON Schema provided doesn't include any specific provisions for pagination. To implement pagination, you would need to provide additional information in the JSON data that represents each feed, such as the number of entries per page and the current page number, etc.

[tschmidtb51]

We probably don't have to edit the CSAF ROLIE schema, but probably we can mention it in the documentation? If a ROLIE feed has pagination, will it fail validation of this schema?

The validation won't fail in the "simple" version but in the "strict" one. The "simple" one will just ignore any property that is not in the schema.

I didn't implement all the fields from section 6.1. So the question is: Should we do that? I guess it could be beneficial...

@sthagen, @santosomar: Thoughts?

[sthagen]

Suggest we maintain lowercase file names and identities.

Maybe we should discuss the folder location also, as schema validation often is tried with identifying an identifier with a URL and maybe OASIS TC admins can help us with the folder location of schemas added "after the fact" of standardization - in the related issue I suggest using a sibling folder to json_schema with an optional_ prefix. @chet-ensign @OASIS-OP-Admin can maybe guide us here?

[tschmidtb51]

Converting it back to draft to implement missing fields and address changes from reviewers.

[oxisto]

Are there any plans to continue this? I could volunteer to pick this up again. I think this would be very helpful to implement ROLIE in kotlin-csaf.

[tschmidtb51]

Are there any plans to continue this? I could volunteer to pick this up again. I think this would be very helpful to implement ROLIE in kotlin-csaf.

Plans: yes, but it has been a low priority for the editors.
So, if you want to volunteer - please go ahead.

[oxisto]

Are there any plans to continue this? I could volunteer to pick this up again. I think this would be very helpful to implement ROLIE in kotlin-csaf.

Plans: yes, but it has been a low priority for the editors. So, if you want to volunteer - please go ahead.

Got it. We got it to work in our initial implementation and I will test this with different providers now, if we encounter any issues, I will update the schema accordingly.

[tschmidtb51]

Please also have a look at the reviewers' comments and address them in you approach.

Also, please move the JSON Schema into the referenced_schemas/rfc8322

[oxisto]

Please also have a look at the reviewers' comments and address them in you approach.

Also, please move the JSON Schema into the referenced_schemas/rfc8322

Got it, I probably need to create a new pull request for this then, since I edit this one.

[tschmidtb51]

Got it. We got it to work in our initial implementation and I will test this with different providers now, if we encounter any issues, I will update the schema accordingly.

Note, that some features might not be used yet but publicly available providers (e.g. pagination).

[milux]

For completeness, I want to note that additional category fields have been introduced at $.feed.entry.category in the BSI CSAF provider, see https://wid.cert-bund.de/.well-known/csaf/white/bsi-wid-white.json, for instance.
These cause the kotlin-csaf JSON parser to crash. We are going to allow additional fields (will be ignored during parsing) for the ROLIE feed JSONs as a workaround for now.

[bernhardreiter]

In gocsaf/csaf#702 (comment) there is a discussion about what I could find in the standard of the current use of category values to ROLIE feed entries.