CloudSecurityAlliance / gsd-tools

Global Security Database Tools
https://gsd.id
Apache License 2.0
41 stars 20 forks source link

schema.gsd.id Cloudflare Worker for schema $refs #177

Closed joshbuker closed 1 year ago

joshbuker commented 1 year ago

Allow validators to resolve even if the source returns text/plain

Transparent pull and reserve with proper content type.

kurtseifried commented 1 year ago

schema.gsd.id/DOMAIN/SCHEMA-NAME.json (latest) or SCHEMA-NAME-1.2.3.json correct?

so e.g. schema.gsd.id/osv.dev/osv-1.5.0.json or schema.gsd.id/gsd.id/osv-gsd-1.0.0.json

16:42

joshbuker commented 1 year ago

I would be tempted to do a slightly different encoding, but that works, yes.

Alternative idea: https://schema.gsd.id/DOMAIN/SCHEMA-NAME/version

e.g. https://schema.gsd.id/osv.dev/osv/latest https://schema.gsd.id/osv.dev/osv/1.5.0 https://schema.gsd.id/gsd.id/osv-gsd/1.0.0

kurtseifried commented 1 year ago

I think your way is better. So I'll do that. Also for content type we'll use: application/schema+json as per the draft spec:

https://json-schema.org/draft/2019-09/json-schema-core.html

kurtseifried commented 1 year ago

Oh I remember why I wanted to do it my way, it can just be files in a directory attached to cloudflare pages.

joshbuker commented 1 year ago

Per slack discussion, could also do:

https://schema.gsd.id/osv.dev/osv/latest/schema.json https://schema.gsd.id/osv.dev/osv/1.5.0/schema.json https://schema.gsd.id/gsd.id/osv-gsd/1.0.0/schema.json

And do a direct file mapping.

kurtseifried commented 1 year ago

Ok as per discussion we went with human firendly and machine friendly layout:

For humans we have the files with the version number embedded, e.g.: gsd.id/osv-gsd/schema-osv-gsd-1.0.1.json

For computers we have the files in directories with the version number, e.g.: gsd.id/osv-gsd/1.0.1/schema.json

The latest version of the schema is in the root directory and called schema.json, e.g.: gsd.id/osv-gsd/schema.json

kurtseifried commented 1 year ago

also I'm using cloudflare pages which serves the json as "application/json" (and doesn't seem to lead _headers rewrite it), to get the proper "application/schema+json" we'll need to use a cloudflare worker or something that allows control of the header. That's a future problem/