publishedTime redefined in EpssVulnAssessmentRelationship

spdx / spdx-3-model

Other

64 stars 41 forks source link

publishedTime redefined in EpssVulnAssessmentRelationship #783

Open mugicha101 opened 3 weeks ago

mugicha101 commented 3 weeks ago

Within the Security profile, both EpssVulnAssessmentRelationship and its parent class VulnAssessmentRelationship define publishedTime.

Looks like publishedTime within EpssVulnAssessmentRelationship should be an external property restriction instead as the only difference is minCount: 1.

bact commented 4 days ago

Should we also remove

- /Core/Relationship/to
  - minCount: 1

from VulnAssessmentRelationship as well?

As /Core/Relationship already has minCount: 1 for to.

goneall commented 3 days ago

Agree we should fix both issues (/Core/Relationship/to and moving publishedTime to external property restrictions).