Merge pull request #76 from RedHatProductSecurity/cpe

Rename navigation and add code blocks

Author: oaubrey

docs/cpe.md

@@ -1,38 +1,41 @@
 # Identifying Red Hat components using CPEs
+Common Platform Enumeration (CPE) is a standardized method of describing and identifying classes of applications,
+operating systems, and hardware devices present among an enterprise's computing assets.
 
+Red Hat uses CPEs to uniquely identify each product and version, following the CPE 2.2 schema.
 
 ## RHEL 10 CPEs
 Starting with  RHEL 10, we will change the way CPEs are assigned to RHEL:
 
-* Minor versions will be used in CPEs for mainstream RHEL versionss
-* The cpe:/o prefix will be used instead of mixed usage of cpe:/o and cpe:/a for all RHEL variants
+* Minor versions will be used in CPEs for mainstream RHEL versions
+* The `cpe:/o` prefix will be used instead of mixed usage of `cpe:/o` and `cpe:/a` for all RHEL variants
 * The channel specifiers are being dropped
 
 
 ### Minor Version CPEs
-Previously, for RHEL 9 and earlier we assigned generic CPEs like cpe:/o:redhat:enterprise_linux:9 for the entire 
-lifetime of a major release. Minor versions were only reflected in xUS CPEs (e.g., cpe:/a:redhat:rhel_eus:9.2::appstream).
+Previously, for RHEL 9 and earlier we assigned generic CPEs like `cpe:/o:redhat:enterprise_linux:9` for the entire 
+lifetime of a major release. Minor versions were only reflected in xUS CPEs (e.g., `cpe:/a:redhat:rhel_eus:9.2::appstream`).
 
 Starting with RHEL 10 and all following versions of RHEL, we will use minor versions in mainstream CPEs, 
-e.g., cpe:/o:redhat:enterprise_linux:10.0, incrementing with each subsequent minor release. This will apply to the 
+e.g., `cpe:/o:redhat:enterprise_linux:10.0`, incrementing with each subsequent minor release. This will apply to the 
 MAIN, GA, and MAIN.EUS variants. This makes it easier to determine which version of RHEL an advisory was released for 
 without consulting ET product configuration. This also improves our way of tracking releases and which sets of 
 advisories they shipped. More granular minor versions also allow for the use of version ranges later on, which can be 
 used to sets of versions (without having to enumerate them all) where the security status such as "fixed" is applicable.
 
 ### CPE Type Standardization
-Previously, we used a mix of cpe:/o (operating system) and cpe:/a (application) for different variants of RHEL 
+Previously, we used a mix of `cpe:/o` (operating system) and `cpe:/a` (application) for different variants of RHEL 
 (for example, base OS used o and Appstream used a). It is unclear why we decided on this different usage and we've 
 encountered various issues in our security data files where consumers have to account for both prefixes even though 
 they identify the same products.
 
-Starting with RHEL 10 and all following versions of RHEL, we will standardize on cpe:/o for all RHEL-related components
-(those shipped under the RHEL product in Errata Tool). EUS CPEs will also transition from cpe:/a to cpe:/o, for example:
-Base OS: cpe:/o:redhat:enterprise_linux_eus:10.2
-AppStream: cpe:/o:redhat:enterprise_linux_eus:10.2
+Starting with RHEL 10 and all following versions of RHEL, we will standardize on `cpe:/o` for all RHEL-related components
+(those shipped under the RHEL product in Errata Tool). EUS CPEs will also transition from `cpe:/a` to `cpe:/o`, for example:
+Base OS: `cpe:/o:redhat:enterprise_linux_eus:10.2`
+AppStream: `cpe:/o:redhat:enterprise_linux_eus:10.2`
 
 ### Removal of channel specifiers and consistent naming of EUS CPEs
-CPEs for RHEL 9 and earlier used channel specifiers such as ::appstream and ::baseos to differentiate between different
+CPEs for RHEL 9 and earlier used channel specifiers such as `::appstream` and `::baseos` to differentiate between different
 Errata Tool Variants and pin a specific CPE to a set of RPM repositories. These specifiers were never used externally
 by any vendor or any of our external documents for any reason other than arbitrary differentiation between groups of
 content. Starting with RHEL 10, we will drop the use of channel specifiers for RHEL. We will continue using them for

mkdocs.yml

@@ -36,11 +36,11 @@ theme:
 
 nav:
   - Home: "index.md"
-  - SBOM: "sbom.md"
-  - purl: "purl.md"
+  - CPE: "cpe.md"
   - CSAF/VEX: "csaf-vex.md"
-  - cpe: "cpe.md"
-
+  - purl: "purl.md"
+  - SBOM: "sbom.md"
+  
 plugins:
   - social
   - search