Hi David, Good to hear from you again. Incorporating pURLs into the NVD is something we have on our wish list. I'm hoping by the end of 2025 we will be drawing up requirements for how to do this. We have several large work items to get done before this one. Perhaps you'd be interested in collaborating with us when the time comes to do this work?
Thanks, Tanya * * * * * Tanya Brewer she / her / hers NVD Program Manager Computer Security Division /ITL NIST -----Original Message----- From: Booth, Harold (Fed) <[email protected]> Sent: Monday, December 2, 2024 8:09 AM To: David A. Wheeler <[email protected]>; [email protected]; Brewer, Tanya L. (Fed) <[email protected]> Cc: Wheeler, David A <[email protected]>; cpe_dictionary <[email protected]>; Kate Stewart <[email protected]>; Samir Khakimov <[email protected]>; Holger Levsen <[email protected]>; Turner, Christopher A. (Fed) <[email protected]> Subject: RE: Should Debian ask for a CPE when a CVE in Debian is found? Hi David, Noting that the statement below described the world in 2016, which looks different than one we now have in 2024. I have not been involved with the NVD program for quite some time (~2017/2018), and I have cc'ed Tanya Brewer who now leads the program. Regards, -Harold -----Original Message----- From: David A. Wheeler <[email protected]> Sent: Sunday, December 1, 2024 3:30 PM To: Booth, Harold (Fed) <[email protected]>; [email protected] Cc: Wheeler, David A <[email protected]>; cpe_dictionary <[email protected]>; Kate Stewart <[email protected]>; Samir Khakimov <[email protected]>; Holger Levsen <[email protected]> Subject: Re: Should Debian ask for a CPE when a CVE in Debian is found? > On Feb 12, 2016, at 12:50 PM, Booth, Harold <[email protected]> wrote: > > We welcome and encourage participation from any vendor to provide us with > this information. We will be happy to work with Debian to accept their CPE > submissions for products that they release. What would help you to get > started? We can set-up a quick call if that would help, otherwise the > [email protected] email is the correct place for submissions. > > Related to CPE, is another software identification scheme, Software ID (SWID) > Tags (ISO 19770-2:2015) that we think provides more capability and benefit. > We have a document currently in draft, NIST IR 8060 > (http://csrc.nist.gov/publications/PubsDrafts.html#NIST-IR-8060), that > describes how to create and use SWID tags as well as some use cases. I > mention the SWID tags since we can also auto generate CPEs from those, and we > see SWID tags as longer term solution to the problem of software product > identification and inventory. FYI: For longer-term identification of software components, I would suggest considering purls instead. These are *MUCH* simpler for identification of OSS components, which matters for the millions of OSS components that exist. The purl format is supported in SPDX, CycloneDX, OSV, and many other formats. Specification for purl here: https://github.com/package-url/purl-spec For Debian specifically, there's already a format specifically for it. An example (with extras): pkg:deb/debian/[email protected]?arch=i386&distro=jessie The OpenSSF responded to CISA about naming issues in 2023 (I facilitated the report). Summary here: https://openssf.org/blog/2023/12/11/openssf-responds-to-the-cisa-rfc-on-software-identification-ecosystem-analysis/ It notes that "Purl is currently in use as a de facto standard in many situations" and the value of using DNS-based approaches (purl is one). --- David A. Wheeler
