search

ossf / osv-schema

Open Source Vulnerability schema.
https://ossf.github.io/osv-schema/
Apache License 2.0
177 stars 75 forks source link

Add support for optional published and modified dates for URL data #36

Closed kurtseifried closed 2 weeks ago

kurtseifried commented 2 years ago

So I'm finding timeline analysis is a lot easier when the Source URLs are tagged with time data, can I suggest we add an (optional, not required) support for a publishedDate and lastModifiedDate, e.g. almost all Red Hat RHSA's have it (Issued: 2017-11-16 Updated: 2017-11-16), Debian DSA (Date Reported: 09 Mar 2022), and so on.

oliverchang commented 2 years ago

Thanks @kurtseifried This seems like really useful information that would ideally be tracked in database_specific. We are trying to keep the schema lean. Even if these are optional fields, adding more to the spec will unfortunately make it harder to understand.

Of course, if there is more demand from other vulnerability databases for this, we'd be much more open to adding this.

I'll keep this open for further discusison.

oliverchang commented 2 weeks ago

Closing due to lack of discussion on this.