User Question: Selection List schema inconsistencies

[peinjoh]

Hey there,

we're building https://github.com/csaf-rs/ssvc as part of the CSAF rust ecosystem. During the implementation of the SSVC validation, I came across some inconsistencies that I would like to discuss:

1. In the SelectionList JSON schema, the Reference def has this description:

A reference to a resource that provides additional context about the decision points or selections. This object is intentionally minimal and contains only the URL and an optional description.

The object has onl two properties uri and summary, but both are listed as required, which contradicts the description, which lists summary as optional. Further, if summary being required is correct, I would suggest some minLength to prevent empty strings in an required field.

2. The SelectionList JSON schema defines selections as an array of def Selection with at least one element.
   To my understanding, the python implementation does not check if multiple of the same decision point (i.e. same namespace, key, version) are provided in selections. Which information is conveyed by having, for example, two ssvc E version 1.1.0 selections (potentially with contradicting values)?

[sei-vsarvepalli]

For the request (1) may be update the text to say summary required. It looks like valuable to have a summary field with minimal 1 char string.

For the request (2) - copilot recommends two methods to be added to https://github.com/CERTCC/SSVC/blob/main/src/ssvc/selection.py in the repository

@field_validator("selections")
@classmethod
def validate_unique_decision_points(
    cls, selections: list[Selection]
) -> list[Selection]:
    seen: set[tuple[str, str, str]] = set()
    duplicates: set[tuple[str, str, str]] = set()

    for sel in selections:
        ident = (sel.namespace, sel.key, sel.version)
        if ident in seen:
            duplicates.add(ident)
        else:
            seen.add(ident)

    if duplicates:
        dup_str = ", ".join(
            f"{ns}:{key}:{ver}" for ns, key, ver in sorted(duplicates)
        )
        raise ValueError(
            "selections must not contain duplicate decision points "
            f"(namespace,key,version). Duplicates: {dup_str}"
        )

    return selections

also update the add_selection method to be complete.

def add_selection(self, selection: Selection) -> None:
    ident = (selection.namespace, selection.key, selection.version)
    existing = {(s.namespace, s.key, s.version) for s in self.selections}
    if ident in existing:
        ns, key, ver = ident
        raise ValueError(
            f"Selection already exists for decision point {ns}:{key}:{ver}"
        )
    self.selections.append(selection)

[peinjoh]

Should I prepare PRs for this?

[sei-vsarvepalli]

Should I prepare PRs for this?

Yes, please. We would love your contribution. Help us by making Sur your PR is editable by the repository maintainers. If you can keep some Test Cases to support python library update, that will be great as well.I believe our Explorer tool https://certcc.github.io/SSVC/ssvc-explorer/ JavScript tooling already prevent duplicate when you attempt to add a new decision point. It may be worth having a look to see if it is reliable enough -

SSVC/docs/ssvc-explorer/simple.js

Line 1591 in 675fda1

function disable_current_dps(options) {