Skip to content

Commit 564b37a

Browse files
committed
Changes to document section added
1 parent d519ad8 commit 564b37a

1 file changed

Lines changed: 107 additions & 4 deletions

File tree

docs/vex-alpha-details.md

Lines changed: 107 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,115 @@
11
# CSAF-VEX Alpha Details
22

3-
This document is intended to cover the changes made in the new release of Alpha VEX files compared to the legacy VEX files.
3+
This document is intended to cover the changes made in the new release of Alpha VEX files compared to the legacy VEX files. These changes are broken out by the three main CSAF VEX document sections: Document, Product Tree and Vulnerabilities.
44

5-
## Document Changes
5+
## Document Section
66

7-
## Product Tree Changes
7+
### Document Changes
88

9-
## Vulnerabilities Changes
9+
#### Title
10+
Previously, the `document.title` followed the format component:CVE title. The title in the Alpha VEX files removed the component prefix. This decision was made to simplify the title and remove confusion when a CVE affects multiple components.
11+
12+
```json
13+
# Example of legacy VEX title
14+
"title": "glibc: Integer overflow in memalign leads to heap corruption",
15+
```
16+
17+
```json
18+
# Example of Alpha VEX title
19+
"title": "Integer overflow in memalign leads to heap corruption",
20+
```
21+
22+
#### Tracking
23+
The `document.tracking` object has two changes in the new Alpha VEX files: the generator name has changed and the revision hisotry has been simplified.
24+
25+
In the new Alpha VEX files, the `document.tracking.generator.engine.name` now references the new service responsible for creating VEX files, "CSAF Generator".
26+
27+
```json
28+
# Example of legacy VEX generator
29+
"generator": {
30+
"date": "2026-02-24T17:08:13+00:00",
31+
"engine": {
32+
"name": "Red Hat SDEngine",
33+
"version": "4.7.1"
34+
}
35+
},
36+
37+
```
38+
39+
```json
40+
# Example of Alpha VEX generator
41+
"generator": {
42+
"date": "2026-02-27T12:07:46+00:00",
43+
"engine": {
44+
"name": "CSAF Generator",
45+
"version": "1.0.3"
46+
}
47+
},
48+
```
49+
50+
The `document.tracking.revision_history` has also been updated in the new Alpha VEX files. Previously, the revision history object implemented some logic to create a history of changes, which was neither accurate nor comprehensive of the historical changes to an individual VEX file. In the new Alpha VEX files, there will only be one revision that represents the last generated version.
51+
52+
```json
53+
# Example of legacy VEX revision history
54+
"revision_history": [
55+
{
56+
"date": "2026-01-14T21:01:11.037000+00:00",
57+
"number": "1",
58+
"summary": "Initial version"
59+
},
60+
{
61+
"date": "2026-02-10T16:17:28+00:00",
62+
"number": "2",
63+
"summary": "Current version"
64+
},
65+
{
66+
"date": "2026-02-24T17:08:13+00:00",
67+
"number": "3",
68+
"summary": "Last generated version"
69+
}
70+
],
71+
```
72+
73+
```json
74+
# Example of Alpha VEX revision history
75+
"revision_history": [
76+
{
77+
"date": "2026-02-27T12:07:46+00:00",
78+
"number": "1",
79+
"summary": "Last generated version"
80+
}
81+
],
82+
83+
```
84+
85+
### Removed Objects
86+
The following optional objects were removed in the Document section and will not be present in the new Alpha VEX files:
87+
88+
* `document.distribution`
89+
* `document.lang`
90+
* `document.notes`
91+
* `document.references`
92+
93+
94+
## Product Tree Section
95+
96+
### Branch Removal
97+
98+
### Product Changes
99+
100+
#### Product Granularity
101+
102+
#### Product Names
103+
104+
### Component Changes
105+
106+
#### Architectural Changes
107+
108+
## Vulnerabilities Section
109+
110+
### Remediations
111+
112+
### CVSS Score
10113

11114
## How to Provide Feedback
12115

0 commit comments

Comments
 (0)