Release date

[tziemek]

Hi there,

is there a way on how decision points are released, meaning when they are supposed to be used by the public?
There is a validation test for CSAF documents https://docs.oasis-open.org/csaf/csaf/v2.1/csaf-v2.1.html#usage-of-non-latest-ssvc-decision-point-version where the release date of the decision point is needed.
Is it "released" when it first appears on the main branch, or should we check the github releases, or is there another way? An easy machine readable way to determine the release date would be very useful.
Thanks in advance for your help.

[sei-vsarvepalli]

@adh - The current release process puts out the https://certcc.github.io/SSVC/data/json/ssvc_object_registry.json that has all the available decision points that should be considered production. We should add a timestamp of the release date in this registry.

[sei-vsarvepalli]

@tziemek
Sorry for the long silence. You can use the https://certcc.github.io/SSVC/data/json/ssvc_object_registry.json and iterate to find all the latest versions of decision point. As mentioned in the ticket earlier, we could add a timestamp to indicate the registry has been updated.

[tziemek]

Thank you, a release date would be really helpful. Are you able to that retroactively or will all the currently listed decision points have the same date?

[sei-vsarvepalli]

I was planning to add the release date only be in the Object Registry. The historic changes, I am not quite sure of. Perhaps these can be seen from GitHub - I hope like git blame will help there.

Vijay

[tziemek]

If there is only a generatedAt at the object registry level, we still have go through the complete git history of the file (hoping the schema hasn't changed that much) and manually evaluate the release date. Having an archive of released object registries could maybe make this a little easier, especially compared to having a releasedAt for each decision point.

[sei-vsarvepalli]

I think if you want to get the latest decision point you can do so with version number - semver. There is some information on versioning rules https://certcc.github.io/SSVC/adr/0003-ssvc-decision-point-versioning-rules/ . I Amy not understand your use case well. But iterating through the registry should give you latest decision point by its version number.

[tziemek]

Getting the latest decision point should be no problem with everything you pointed out.
We need to have the latest available version at a given time, in order to check if that one was used (and not an older one or one that was not available at that time). A releasedAt field on the decision point would make this really easy.

[sei-vsarvepalli]

Hello @tziemek

Currently I am not convinced another "releasedAt" field is needed for the decision point release. The version number is sufficient IMO. Perhaps we can create a clear documentation on release-branch (publish), development-branch (main) so it is clear in the README file?

[tziemek]

I think I can go with having it only at the object registry level. Would it then be possible to have a public archive of those files? So I won't have to go through the git history and compare them, but have distinct files when there are changes?

[sei-vsarvepalli]

🤔

Here is what I was actually thinking. It may not be sufficient for you? You can fetch to file to see if there is a newer version online and decide to parse it for namespace/key/version/ to decide if a new release of decision point has been published.

curl -s -z ssvc_object_registry.json -o ssvc_object_registry.json https://certcc.github.io/SSVC/data/json/ssvc_object_registry.json

or a python like like below:

import os
import json
import requests

def fetch_if_changed(url: str, local_path: str, cache_file: str = ".fetch_cache.json") -> bool:
    """Downloads a URL only if the remote ETag or Last-Modified header has changed."""
    if not local_path:
        local_path = os.path.basename(urlparse(url).path) or "downloaded_file"
    if not cache_file:
        cache_file = f".{local_path}.cache.json"
    cache = {}
    if os.path.exists(cache_file):
        with open(cache_file, "r") as f: cache = json.load(f)
    headers = {}
    if os.path.exists(local_path) and url in cache:
        if cache[url].get("etag"): headers["If-None-Match"] = cache[url]["etag"]
        if cache[url].get("lm"): headers["If-Modified-Since"] = cache[url]["lm"]

    res = requests.get(url, headers=headers, stream=True)
    if res.status_code == 304:
        return False  # Unchanged
        
    res.raise_for_status()
    
    with open(local_path, "wb") as f:
        for chunk in res.iter_content(8192): f.write(chunk)
            
    cache[url] = {"etag": res.headers.get("ETag"), "lm": res.headers.get("Last-Modified")}
    with open(cache_file, "w") as f: json.dump(cache, f, indent=2)
    return True

My big assumption is when the CSAF SSVC metrics is generated with the timestamp 2024-01-24T10:00:00.000Z that the test/evaluation happens pretty much at that time. So you are not verifying a past CSAF document I suppose is my assumption. If a CSAF document is evaluated much later what you are looking for perhaps is more appropriate.

If so, can you provide a proposed PR that will archive the current data/json/ssvc_object_registry.json file in a way useful to your process. It seems to me like that will help move in a direction to bring this to our SSVC internal group discussion.

Thanks