CPEs and PURLs

[ammar92]

CPE (Common Platform Enumeration) and PURL (Package URL) are two primary software identifiers. Currently we use optional CPEs attached to Software OOIs. Some questions and points for discussion:

• Should we adopt PURLs alongside CPEs?
• Should both CPEs and PURLs coexist in our models?
• CPEs and PURLs have some degree of interoperability, should we utilize this relationship?
• The current Software.cpe field should be refactored into its own model
  • This would allow a tree-like structure where other Software or SoftwareInstance models can reference this model
  • A tree-like structure would also enable parent-child relationships (e.g. jQuery 3.7.1 links to jQuery)
    • This allows targeting specific versions of software packages or referring to a software package in general (e.g. having a CVE refer to a specific jQuery version X, or have a policy that completely disallows the usage of jQuery)
    • This approach also enables linking plugins and extensions to their associated software

[underdarknl]

related #278

[noamblitz]

• The current Software.cpe field should be refactored into its own model

Dont agree with this point. Would IMO unnecessarily add more OOIs to the graph. Interesting point for a short discussion though! Let's discuss this soon (in small a group).

[ammar92]

• The current Software.cpe field should be refactored into its own model

Dont agree with this point. Would IMO unnecessarily add more OOIs to the graph. Interesting point for a short discussion though! Let's discuss this soon (in small a group).

I understand the concern about potentially adding more OOI types, but I believe refactoring the Software.cpe field into its own model brings significant benefits as outlined in the original point. From a database/modeling perspective, this field should ideally have been normalized into a separate model from the start (duplication is one reason, but there're a few more).

A separate model provides flexibility in managing software identifiers, enables the creation of parent-child relationships (essential for linking and comparing, versions, plugins, and extensions), and simplifies referencing across multiple instances or models.

I’d be happy to discuss this further as proposed.

(migration is another discussion/ challenge 😅)