Skip to content

Commit 262dc3e

Browse files
alilleybrinkeralilleybrinker
committed
Update README.md to be clearer.
This amends the `README.md` file to be clearer to navigate. This is achieved in several ways: - All links are now hyperlinks on explanatory text, instead of bare URLs. - Where appropriate, information has been gathered into tables. - How to participate in the QWG and contribute in the repository has been spelled out explicitly. - The distinction between the "production" and "development" versions of the format have been clearer by being split into distinct sections. Signed-off-by: Andrew Lilley Brinker <[email protected]>
1 parent c57ec63 commit 262dc3e

File tree

1 file changed

+117
-43
lines changed

1 file changed

+117
-43
lines changed

‎README.md

+117-43
Original file line numberDiff line numberDiff line change
@@ -1,43 +1,117 @@
1-
# Current Version of CVE Record Format
2-
3-
Update to cve-schema to provide better support for CPE!! if you have integrations that rely on the cve-schema repo structure, please review the changes here. The latest version of the CVE JSON Record Format is 5.1.1. A single schema file with bundled dependencies is available [here](https://github.com/CVEProject/cve-schema/blob/master/schema/docs/CVE_Record_Format_bundled.json).
4-
5-
Note: The CVE Record Format now supports Authorized Data Publisher (ADP) containers there is one active ADP currently. The CVE Program uses a separate ADP container to provide additional CVE information (e.g., references) for some records. Access this README.md page [here](
6-
https://github.com/CVEProject/cvelistV5/blob/main/README.md)
7-
for more information about the CVE Program Container.
8-
9-
Note: Please refer to the CVE Services page [here](https://www.cve.org/AllResources/CveServices) for known issues with the schema.
10-
11-
# CVE Record Format Overview
12-
13-
cve-schema specifies the CVE Record Format. This is the blueprint for a rich set of JSON data that can be submitted by CVE Numbering Authorities (CNAs) and Authorized Data Publishers (ADPs) to describe a CVE Record. Some examples of CVE Record data include CVE ID number, affected product(s), affected version(s), and public references. While those specific items are required when assigning a CVE, there are many other optional data in the schema that can be used to enrich CVE Records for community benefit.
14-
15-
### Learn
16-
17-
Learn more about the CVE program at: https://www.cve.org/
18-
19-
This CVE Record Format is defined using JSON Schema. Learn more about JSON Schema at: https://json-schema.org/ .
20-
21-
### Latest
22-
23-
The latest version of the CVE Record Format is 5.1.1. It is specified in the JSON schema at https://github.com/CVEProject/cve-schema/blob/master/schema/CVE_Record_Format.json
24-
25-
A single schema file with bundled dependencies is at https://github.com/CVEProject/cve-schema/blob/master/schema/docs/CVE_Record_Format_bundled.json
26-
27-
### Documentation and Guidance
28-
29-
Documentation about this format is available at https://cveproject.github.io/cve-schema/schema/docs/
30-
31-
A mindmap version of the CVE Record structure is at https://cveproject.github.io/cve-schema/schema/docs/mindmap.html
32-
33-
More details about Product and Version Encodings in the CVE Record Format are at https://github.com/CVEProject/cve-schema/blob/master/schema/docs/versions.md
34-
35-
### Examples
36-
37-
A basic example of a full record in the 5.1.1 format with minimally required fields is available at https://github.com/cveproject/cve-schema/blob/master/schema/docs/full-record-basic-example.json
38-
39-
An advanced example of a full record in the 5.1.1 format is available at https://github.com/cveproject/cve-schema/blob/master/schema/docs/full-record-advanced-example.json
40-
41-
A basic example of a cnaContainer, to be used with CVE Services, is available at https://github.com/cveproject/cve-schema/blob/master/schema/docs/cnaContainer-basic-example.json
42-
43-
An advanced example of a cnaContainer, to be used with CVE Services, is available at https://github.com/cveproject/cve-schema/blob/master/schema/docs/cnaContainer-advanced-example.json
1+
# CVE Record Format
2+
3+
![GitHub Tag](https://img.shields.io/github/v/tag/cveproject/cve-schema)
4+
![GitHub License](https://img.shields.io/github/license/cveproject/cve-schema)
5+
6+
The **CVE Record Format** is the [JSON schema][json_schema] defining the
7+
structure of CVE records. It was previously called the "CVE Schema." This
8+
repository is maintained by the [CVE Quality Working Group][qwg] (QWG) under
9+
the [QWG Charter][qwg_charter].
10+
11+
This repository is part of the [CVE Project][cve] and is governed by CVE's
12+
[Professional Code of Conduct][coc].
13+
14+
---
15+
16+
## Read the Record Format
17+
18+
The version of the schema found on the [`main` branch][branch_main] of this
19+
repository is the current production version used by CVE Services. The
20+
development version, which reflects work-in-progress changes planned for future
21+
production versions, is found on the [`develop` branch][branch_develop].
22+
23+
### Production Version
24+
25+
The current production version of the CVE Record Format is available in several
26+
forms:
27+
28+
| Format | Link |
29+
|:---------------|:--------------|
30+
| Separate files | [View][fmt_1] |
31+
| Single file | [View][fmt_2] |
32+
| Interactive | [View][fmt_3] |
33+
| Mindmap | [View][fmt_4] |
34+
35+
Additionally, the CVE Record Format incorporates mechanisms for encoding
36+
product identity and version information, which are [documented in greater
37+
detail][products_and_versions].
38+
39+
### Development Version
40+
41+
The development version of the CVE Record Format can be found in the
42+
[`develop` branch][branch_develop]:
43+
44+
| Format | Link |
45+
|:---------------|:--------------|
46+
| Separate files | [View][fmt_5] |
47+
48+
## Examples
49+
50+
| Description | Link |
51+
|:----------------------------------------------------------------------|:-------------|
52+
| Example with minimum required fields | [View][ex_1] |
53+
| More complete example | [View][ex_2] |
54+
| A basic example of a `cnaContainer`, to be used with CVE Services | [View][ex_3] |
55+
| An advanced example of a `cnaContainer`, to be used with CVE Services | [View][ex_4] |
56+
57+
## Known Issues
58+
59+
The CVE Services page on the CVE site tracks
60+
[known issues with the CVE Record Format][known_issues].
61+
62+
## Contributing
63+
64+
Work in this repository is managed by the CVE [Quality Working Group][qwg]. QWG
65+
meetings are open to CVE authorized program members, including:
66+
67+
- Members of the [CVE Board][cve_board]
68+
- Representatives of [CVE Numbering Authorities (CNAs)][cve_cnas]
69+
- Representatives of [Authorized Data Publishers (ADPs)][cve_adps]
70+
- Participants from the [CVE Secretariat][cve_secretariat] (currently
71+
[The MITRE Corporation][mitre])
72+
73+
On a case-by-case basis, the QWG can invite to participate, through consensus,
74+
individuals who are not CVE program members. To request admission to the QWG,
75+
please contact one of the QWG Co-Chairs, currently
76+
[Chris Coffin (MITRE)][cochair_chris_coffin] or
77+
[MegaZone (F5)][cochair_megazone].
78+
79+
Any individual is welcome to participate via [Issues][gh_issues],
80+
[Discussions][gh_discussions], and [Pull Requests][gh_prs], including opening
81+
issues, creating proposals, commenting on existing proposals in Pull
82+
Requests, and asking questions about the Record Format. Decisions on how to
83+
proceed with any proposal are made by the Quality Working Group via consensus.
84+
Final authority for approving or rejecting changes to the CVE Record Format
85+
lies with the [CVE Board][cve_board].
86+
87+
All participation in this project is subject to the rules and procedures of the
88+
[CVE Professional Code of Conduct][coc].
89+
90+
[branch_develop]: https://github.com/CVEProject/cve-schema/tree/develop
91+
[branch_main]: https://github.com/CVEProject/cve-schema/tree/main
92+
[cve]: https://www.cve.org/
93+
[cve_board]: https://www.cve.org/ProgramOrganization/Board
94+
[cve_cnas]: https://www.cve.org/ProgramOrganization/CNAs
95+
[cve_adps]: https://www.cve.org/ProgramOrganization/ADPs
96+
[cve_secretariat]: https://www.cve.org/ResourcesSupport/Glossary?activeTerm=glossarySecretariat
97+
[coc]: https://www.cve.org/ResourcesSupport/AllResources/ProfessionalCodeOfConduct
98+
[cochair_chris_coffin]: https://www.linkedin.com/in/christopher-coffin-1573437/
99+
[cochair_megazone]: https://www.linkedin.com/in/megazone/
100+
[ex_1]: https://github.com/cveproject/cve-schema/blob/main/schema/docs/full-record-basic-example.json
101+
[ex_2]: https://github.com/cveproject/cve-schema/blob/main/schema/docs/full-record-advanced-example.json
102+
[ex_3]: https://github.com/cveproject/cve-schema/blob/main/schema/docs/cnaContainer-basic-example.json
103+
[ex_4]: https://github.com/cveproject/cve-schema/blob/main/schema/docs/cnaContainer-advanced-example.json
104+
[fmt_1]: https://github.com/CVEProject/cve-schema/blob/main/schema/CVE_Record_Format.json
105+
[fmt_2]: https://github.com/CVEProject/cve-schema/blob/main/schema/docs/CVE_Record_Format_bundled.json
106+
[fmt_3]: https://cveproject.github.io/cve-schema/schema/docs/
107+
[fmt_4]: https://cveproject.github.io/cve-schema/schema/docs/mindmap.html
108+
[fmt_5]: https://github.com/CVEProject/cve-schema/blob/develop/schema/CVE_Record_Format.json
109+
[gh_issues]: https://github.com/CVEProject/cve-schema/issues
110+
[gh_discussions]: https://github.com/CVEProject/cve-schema/discussions
111+
[gh_prs]: https://github.com/CVEProject/cve-schema/pulls
112+
[json_schema]: https://json-schema.org/
113+
[known_issues]: https://www.cve.org/AllResources/CveServices
114+
[mitre]: https://www.mitre.org/
115+
[products_and_versions]: https://github.com/CVEProject/cve-schema/blob/main/schema/docs/versions.md
116+
[qwg]: https://github.com/CVEProject/quality-workgroup
117+
[qwg_charter]: https://github.com/CVEProject/quality-workgroup/blob/main/README.md

0 commit comments

Comments
 (0)