search

oasis-open / csaf-documentation

OASIS TC Open Repository: A GitHub repository for management of non-normative information about the work of the CSAF Technical Committee, including documentation
https://oasis-open.github.io/csaf-documentation/
BSD 3-Clause "New" or "Revised" License
19 stars 10 forks source link

Product Tree - Relationship - Question (possible Error) #6

Open dstrohl opened 3 years ago

dstrohl commented 3 years ago

in version 1.2 (http://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/cs01/csaf-cvrf-v1.2-cs01.html#_Toc493508771) section 5.1.3

This section indicates that the prod:Relationship element would contain ONE OR MORE prod:FullProductName elements

The prod:Relationship element MUST be present with cardinality [0, ∞] in prod:Tree and if given MUST contain one or more prod:FullProductName instances. » [CSAF-5.1.3-1]

My understanding of this element is that you are creating a new FullProductName object by relating multiple other elements. This makes sense,

However, I cant figure out an example where you would define MULTIPLE FullProductName objects from that relationship.

So, from the docs, this woudl be legal.

<Relationship ProductReference="CVRFPID-0007" RelationType="Optional Component Of" RelatesToProductReference="CVRFPID-0008">

AD Dir Services product another AD Dir Services product

Is that the intent or is the "ONE or MORE" incorrect? and if it is correct, can you post an example of when that might be useful?

tschmidtb51 commented 3 years ago

This is changed in CSAF 2.0. See oasis-tcs/csaf#99 for details.