gsd-analysis about gsd-tools

[kurtseifried]

Right now we're going with mono-repo for gsd-tools and contents, longer-term as projects mature/grow we'll probably break them out, but for now, especially with modern tooling, a mono repo greatly simplifies things.

One comment on schemas: with the namespacing I'm hoping most of the schemas we end up using/supporting also have identification and versioning, e.g.

OSV has
"schema_version": string
but no schema_type:: "OSV" which would make things simple

CVE has
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",

so writing a basic library that would take the base data, the namespace data and so on, look at the JSON and tell you what format it most likely is shouldn't be that hard. Then the trick becomes applying schema to ensure correctness and what to do with nonstandard/incorrect data (e.g. did someone add a random tag? make a typo? etc...).

One goal is for GSD to not invent yet another format but to use mostly OSV with some additional tags as we've mentioned on the mailing list/issues.

Do you want a gsd-analysis/ directory in the gsd-tools repo to put your stuff? If so just send a PR and it shouldn't take to long to merge.

[joshbuker]

This was merged into the tools repo, going to close it out until there's more on the topic.