Skip to content

Commit 280331f

Browse files
ahouseholderahouseholder
authored
Publish SSVC v2025.3.2 (#767)
2 parents 41be0ea + 20a7a9c commit 280331f

File tree

8 files changed

+227
-237
lines changed

8 files changed

+227
-237
lines changed

‎data/schema/v1/Decision_Point-1-0-1.schema.json‎

Lines changed: 68 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -4,97 +4,97 @@
44
"$id": "https://certcc.github.io/SSVC/data/schema/v1/Decision_Point-1-0-1.schema.json",
55
"description": "Decision points are the basic building blocks of SSVC decision functions. Individual decision points describe a single aspect of the input to a decision function.",
66
"$defs": {
7-
"schemaVersion": {
7+
"schemaVersion": {
88
"description": "Schema version used to represent this Decision Point.",
99
"type": "string",
1010
"enum": ["1-0-1"]
1111
},
12-
"decision_point_value": {
12+
"decision_point_value": {
1313
"type": "object",
14-
"additionalProperties": false,
14+
"additionalProperties": false,
1515
"properties": {
1616
"key": {
1717
"type": "string",
1818
"description": "A short, unique string (or key) used as a shorthand identifier for a Decision Point Value.",
19-
"minLength": 1,
20-
"examples": ["P", "Y"]
19+
"minLength": 1,
20+
"examples": ["P", "Y"]
2121
},
2222
"name": {
2323
"type": "string",
2424
"description": "A short label that identifies a Decision Point Value",
25-
"minLength": 1,
26-
"examples": ["Public PoC", "Yes"]
25+
"minLength": 1,
26+
"examples": ["Public PoC", "Yes"]
2727
},
2828
"description": {
2929
"type": "string",
3030
"description": "A full description of the Decision Point Value.",
31-
"minLength": 1,
32-
"examples": ["One of the following is true: (1) Typical public PoC exists in sources such as Metasploit or websites like ExploitDB; or (2) the vulnerability has a well-known method of exploitation.","Attackers can reliably automate steps 1-4 of the kill chain."]
31+
"minLength": 1,
32+
"examples": ["One of the following is true: (1) Typical public PoC exists in sources such as Metasploit or websites like ExploitDB; or (2) the vulnerability has a well-known method of exploitation.","Attackers can reliably automate steps 1-4 of the kill chain."]
3333
}
3434
},
35-
"required" : [
36-
"key",
37-
"name",
38-
"description"
39-
]
40-
},
41-
"decision_point": {
42-
"type": "object",
43-
"additionalProperties": false,
44-
"properties": {
45-
"schemaVersion": {
46-
"$ref": "#/$defs/schemaVersion"
47-
},
48-
"namespace": {
49-
"type": "string",
50-
"description": "Namespace (a short, unique string): The value must be one of the official namespaces, currenlty \"ssvc\", \"cvss\" OR can start with 'x_' for private namespaces. See SSVC Documentation for details.",
51-
"pattern": "^(?=.{3,25}$)(x_)?[a-z0-9]{3}([/.-]?[a-z0-9]+){0,22}$",
52-
"examples": ["ssvc", "cvss", "x_custom","x_custom/extension"]
53-
},
54-
"version": {
55-
"type": "string",
56-
"description": "Version (a semantic version string) that identifies the version of a Decision Point.",
57-
"pattern": "^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?$",
58-
"examples": ["1.0.1", "1.0.1-alpha"]
59-
},
60-
"key": {
61-
"type": "string",
35+
"required" : [
36+
"key",
37+
"name",
38+
"description"
39+
]
40+
},
41+
"decision_point": {
42+
"type": "object",
43+
"additionalProperties": false,
44+
"properties": {
45+
"schemaVersion": {
46+
"$ref": "#/$defs/schemaVersion"
47+
},
48+
"namespace": {
49+
"type": "string",
50+
"description": "Namespace (a short, unique string): The value must be one of the official namespaces, currenlty \"ssvc\", \"cvss\" OR can start with 'x_' for private namespaces. See SSVC Documentation for details.",
51+
"pattern": "^(?=.{3,100}$)(x_)?[a-z0-9]{3}([/.-]?[a-z0-9]+){0,97}$",
52+
"examples": ["ssvc", "cvss", "x_custom","x_custom/extension"]
53+
},
54+
"version": {
55+
"type": "string",
56+
"description": "Version (a semantic version string) that identifies the version of a Decision Point.",
57+
"pattern": "^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?$",
58+
"examples": ["1.0.1", "1.0.1-alpha"]
59+
},
60+
"key": {
61+
"type": "string",
6262
"description": "A short, unique string (or key) used as a shorthand identifier for a Decision Point.",
6363

64-
"minLength": 1,
65-
"examples": ["E", "A"]
66-
},
67-
"name": {
68-
"type": "string",
64+
"minLength": 1,
65+
"examples": ["E", "A"]
66+
},
67+
"name": {
68+
"type": "string",
6969
"description": "A short label that identifies a Decision Point.",
70-
"minLength": 1,
71-
"examples": ["Exploitation", "Automatable"]
72-
},
73-
"description": {
74-
"type": "string",
70+
"minLength": 1,
71+
"examples": ["Exploitation", "Automatable"]
72+
},
73+
"description": {
74+
"type": "string",
7575
"description": "A full description of the Decision Point, explaining what it represents and how it is used in SSVC.",
76-
"minLength": 1
77-
},
78-
"values": {
79-
"description": "A set of possible answers for a given Decision Point",
80-
"uniqueItems": true,
81-
"type": "array",
82-
"minItems": 1,
83-
"items": {
84-
"$ref": "#/$defs/decision_point_value"
85-
}
86-
}
87-
},
88-
"required": [
89-
"namespace",
90-
"version",
91-
"key",
92-
"name",
93-
"description",
94-
"values",
95-
"schemaVersion"
96-
]
97-
}
76+
"minLength": 1
77+
},
78+
"values": {
79+
"description": "A set of possible answers for a given Decision Point",
80+
"uniqueItems": true,
81+
"type": "array",
82+
"minItems": 1,
83+
"items": {
84+
"$ref": "#/$defs/decision_point_value"
85+
}
86+
}
87+
},
88+
"required": [
89+
"namespace",
90+
"version",
91+
"key",
92+
"name",
93+
"description",
94+
"values",
95+
"schemaVersion"
96+
]
97+
}
9898
},
9999
"$ref": "#/$defs/decision_point"
100100
}

‎data/schema/v1/Decision_Point_Group-1-0-1.schema.json‎

Lines changed: 37 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -4,49 +4,49 @@
44
"$id": "https://certcc.github.io/SSVC/data/schema/v1/Decision_Point_Group-1-0-1.schema.json",
55
"description": "Decision Point Groups are sets of decision points pinned to specific versions of those decision points. These groups may change over time.",
66
"$defs": {
7-
"schemaVersion": {
7+
"schemaVersion": {
88
"description": "Schema version used to represent Decision Point Group.",
99
"type": "string",
1010
"enum": ["1-0-1"]
1111
},
12-
"decision_point_group": {
13-
"type": "object",
14-
"additionalProperties": false,
15-
"properties": {
16-
"schemaVersion": {
12+
"decision_point_group": {
13+
"type": "object",
14+
"additionalProperties": false,
15+
"properties": {
16+
"schemaVersion": {
1717
"$ref": "#/$defs/schemaVersion"
1818
},
19-
"version": {
20-
"$ref": "https://certcc.github.io/SSVC/data/schema/v1/Decision_Point-1-0-1.schema.json#/$defs/decision_point/properties/version"
21-
},
22-
"name": {
23-
"type": "string",
24-
"description": "A short label that captures the description of the Decision Point Group.",
25-
"minLength": 1,
26-
"examples": ["SSVC Supplier","Coordinator Triage", "SSVC Deployer"]
27-
},
28-
"description": {
29-
"type": "string",
30-
"description": "A full description of the Decision Point Group.",
31-
"minLength": 1,
32-
"examples": ["These decision points used by the Coordinator during publication."]
33-
},
34-
"decision_points": {
35-
"type": "array",
36-
"minItems": 1,
37-
"items": {
38-
"$ref": "https://certcc.github.io/SSVC/data/schema/v1/Decision_Point-1-0-1.schema.json"
39-
}
40-
}
41-
},
42-
"required": [
43-
"version",
44-
"name",
45-
"description",
46-
"decision_points",
47-
"schemaVersion"
48-
]
49-
}
19+
"version": {
20+
"$ref": "https://certcc.github.io/SSVC/data/schema/v1/Decision_Point-1-0-1.schema.json#/$defs/decision_point/properties/version"
21+
},
22+
"name": {
23+
"type": "string",
24+
"description": "A short label that captures the description of the Decision Point Group.",
25+
"minLength": 1,
26+
"examples": ["SSVC Supplier","Coordinator Triage", "SSVC Deployer"]
27+
},
28+
"description": {
29+
"type": "string",
30+
"description": "A full description of the Decision Point Group.",
31+
"minLength": 1,
32+
"examples": ["These decision points used by the Coordinator during publication."]
33+
},
34+
"decision_points": {
35+
"type": "array",
36+
"minItems": 1,
37+
"items": {
38+
"$ref": "https://certcc.github.io/SSVC/data/schema/v1/Decision_Point-1-0-1.schema.json"
39+
}
40+
}
41+
},
42+
"required": [
43+
"version",
44+
"name",
45+
"description",
46+
"decision_points",
47+
"schemaVersion"
48+
]
49+
}
5050
},
5151
"$ref": "#/$defs/decision_point_group"
5252

0 commit comments

Comments
 (0)