Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

container examples incorrectly include providerMetadata #312

Open
ElectricNroff opened this issue May 13, 2024 · 0 comments
Open

container examples incorrectly include providerMetadata #312

ElectricNroff opened this issue May 13, 2024 · 0 comments

Comments

@ElectricNroff
Copy link

"providerMetadata": {
"orgId": "00000000-0000-4000-9000-000000000000"
},

"providerMetadata": {
"orgId": "00000000-0000-4000-9000-000000000000",
"shortName": "example"
},

"providerMetadata": {
"orgId": "00000000-0000-4000-9000-000000000000"
},

The providerMetadata property should be deleted from these files because it is not needed when using CVE Services, and introduces a support cost because users do not immediately know whether to send the specific value of 00000000-0000-4000-9000-000000000000 or the UUID of their organization (or either or neither), and thus sometimes ask the CVE program for additional help.

Similarly, examples should not be inconsistent (shortName above is only in the rejected example, not in the other two).

As shown at https://cveawg.mitre.org/api-docs/#/CVE%20Record/cveCnaCreateSingle

Note: providerMetadata is set by the server. If provided, it will be overwritten.

The same note also occurs at https://cveawg.mitre.org/api-docs/#/CVE%20Record/cveCnaUpdateSingle and https://cveawg.mitre.org/api-docs/#/CVE%20Record/cveCnaCreateReject and https://cveawg.mitre.org/api-docs/#/CVE%20Record/cveCnaUpdateReject as well.

With this change, CNAs who study the examples will be ready to submit CVE Records as soon as they are able to compose and send a container. They will not need to guess that the 00000000-0000-4000-9000-000000000000 value is fine, will not need to make other API calls to look up their organization's UUID, and will not need to think about whether it is appropriate to send data that is documented as will be overwritten.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant