schema/v5.0: flatten affected into array of products

[rsc]

• Changed affected from object with array of vendor objects
  with array of products to just plain array of products.
• Added vendor string to product object.
• Renamed productName to product in product object.
• Added cpes array of string to product object,
  replacing affectsCpes inside old affected object.
• Reordered property list in product object
  to put all identifying fields first.
• Changed programRoutines to be array of objects, not array of strings.
• Defined that product object:
  • Requires a product identification, at least one of:
    • vendor and product
    • collectionURL and packageName
    • cpes
  • Also requires versions.

Based on discussion on issue #86.

[rsc]

I have checked that this is a valid JSON file, but I didn't find any docs explaining additional tests that should be run, either to check that it's a valid JSON schema at all or to check that certain records validate against it.

Are there such tests?

[mprpic]

Are there such tests?

None exist right now but there is a proposal to add that infra here: #55

+1 for the changes in this MR, nice work! They also resolve all of the problems raised in issue #41.

[rsc]

Will work on these edits.

@chandanbn, how does the mindmap get generated?
I wouldn't mind just regenerating it locally (not included in the PR) to check that the schema parses OK and looks right.

[rsc]

Changes made as suggested, except for fixing the CPE regexp.

[chandanbn]

@chandanbn, how does the mindmap get generated?

Currently done manually with this script in combination with https://markmap.js.org/repl/
https://gist.github.com/chandanbn/609cb2a9478c7190421bc86f8bff4dc8

Prefer to get this scripted/automated at some time.

[rsc]

Looking over this again I noticed that I neglected to pull 'platforms' up out of versions and into the product array object as we discussed. I have done that now.

[pombredanne]

@rsc you wrote in #86 (comment)

The upside is the ability to define clear references to vendor-less products, so that CVE can represent open source projects more clearly and not overfit as much to commercial products.

I agree ++... this has been one of the major issue with CPE/CVEs so far. Kudos and thank you for fixing this here; this as a major improvement!