Re: DWF Open Source CNA requirements:

[Art Manion <amanion@cert.org>]

On 2016-11-06 16:03, Kurt Seifried wrote:

> 4. What software specifically will you be assigning CVEs for (this can
> be everything you ship, or a limited subset, either way the DWF will
> require a list of names at a minimum, ideally with URLs to the 
> software)

Is something general allowed, e.g., non-vendor CNAs that might have
broad/not-known-in-advance coverage?

> 5. You must provide a public method (e.g. no login required) for
> published CVEs (e.g. product ChangeLog or a security page with a list 
> of
> CVEs and minimum information as specified in the CNA Rules)

As soon as it's worked out, publication must be in the standard minimum
CVE format and published using the standard transport.

> 10. Once a CVE is made public (e.g. you have fixed the issue) you must
> tell the DWF within 24 hours (by pull request to the
> DWF-Database-Artifacts at a minimum, and optionally the DWF-Database 
> as
> well) using the minimum DWF-Database-Artifact specification currently 
> in
> use
> (https://github.com/distributedweaknessfiling/DWF-Database-Artifacts/blob/master/JSON-file-format-CURRENT.md)
>  

Is performing #10 not the same as #5?

 - Art