Open andrewpollock opened 1 year ago
I would love a canonical mypy schema object that could be imported and used in any python tooling, same for other languages.
Some comments (I'm the tool author):
We can't do this with a "pure" JSON schema because (this is the shortlist):
Also (obviously) we'll be releasing what we build as open source, in that directory long term so keep an eye and hopefully I'll get some more time to build this soon.
+1 that a pure JSON schema is not sufficient. There are other reasons:
schema_version
being required when fields from a newer schema version is used. How about several different packages that all have a single responsibility?
On Wed, Mar 29, 2023, 10:53 PM Oliver Chang @.***> wrote:
+1 that a pure JSON schema is not sufficient. There are other reasons:
- We need to validate package names, versions are valid.
- We can check for e.g. schema_version being required when fields from a newer schema version is used.
- And others that may overlap with @andrewpollock https://github.com/andrewpollock 's work on detecting invalid entries. Maybe some of that should be usable as a standalone tool.
— Reply to this email directly, view it on GitHub https://github.com/ossf/osv-schema/issues/90#issuecomment-1489378316, or unsubscribe https://github.com/notifications/unsubscribe-auth/AA4UYQ436E6CT64IXUVKUVDW6SVOVANCNFSM6AAAAAARB2I54Q . You are receiving this because you commented.Message ID: @.***>
Related: https://github.com/ossf/osv-schema/issues/168 - schema.json "score" pattern too strict in metric ordering, optional metrics not recognised
As part of #761, we became aware that the Cloud Security Alliance has a schema validator.
It seems like shipping a canonical, authoritative validator tool and library with the schema would be best, rather than each ecosystem integrator needing to reinvent the wheel (and possibly less comprehensively than desired).