{"action":"created","issue":{"url":"https://api.github.com/repos/OpenSCAP/openscap/issues/544","repository_url":"https://api.github.com/repos/OpenSCAP/openscap","labels_url":"https://api.github.com/repos/OpenSCAP/openscap/issues/544/labels{/name}","comments_url":"https://api.github.com/repos/OpenSCAP/openscap/issues/544/comments","events_url":"https://api.github.com/repos/OpenSCAP/openscap/issues/544/events","html_url":"https://github.com/OpenSCAP/openscap/issues/544","id":179864002,"node_id":"MDU6SXNzdWUxNzk4NjQwMDI=","number":544,"title":"Use NIST CPEs over customized CPEs","user":{"login":"redhatrises","id":8398836,"node_id":"MDQ6VXNlcjgzOTg4MzY=","avatar_url":"https://avatars2.githubusercontent.com/u/8398836?v=4","gravatar_id":"","url":"https://api.github.com/users/redhatrises","html_url":"https://github.com/redhatrises","followers_url":"https://api.github.com/users/redhatrises/followers","following_url":"https://api.github.com/users/redhatrises/following{/other_user}","gists_url":"https://api.github.com/users/redhatrises/gists{/gist_id}","starred_url":"https://api.github.com/users/redhatrises/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/redhatrises/subscriptions","organizations_url":"https://api.github.com/users/redhatrises/orgs","repos_url":"https://api.github.com/users/redhatrises/repos","events_url":"https://api.github.com/users/redhatrises/events{/privacy}","received_events_url":"https://api.github.com/users/redhatrises/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-09-28T19:23:50Z","updated_at":"2018-10-10T14:49:19Z","closed_at":null,"author_association":"MEMBER","body":"OpenSCAP should use NIST CPEs over the use customized CPEs as NIST CPEs are officially accepted CPEs. PR https://github.com/OpenSCAP/openscap/pull/180 is an example of CPEs that should have been NIST provided CPEs instead of customized CPEs. PR https://github.com/OpenSCAP/openscap/pull/539 shows the correct usage for creating a customized CPE as NIST does not have an official CPE for Amazon Linux.\n\nI haven't looked to see if this is technically feasible to code. This may be a documentation awareness or for the PR reviewer to check and validate.\n"},"comment":{"url":"https://api.github.com/repos/OpenSCAP/openscap/issues/comments/428602133","html_url":"https://github.com/OpenSCAP/openscap/issues/544#issuecomment-428602133","issue_url":"https://api.github.com/repos/OpenSCAP/openscap/issues/544","id":428602133,"node_id":"MDEyOklzc3VlQ29tbWVudDQyODYwMjEzMw==","user":{"login":"jan-cerny","id":9050916,"node_id":"MDQ6VXNlcjkwNTA5MTY=","avatar_url":"https://avatars3.githubusercontent.com/u/9050916?v=4","gravatar_id":"","url":"https://api.github.com/users/jan-cerny","html_url":"https://github.com/jan-cerny","followers_url":"https://api.github.com/users/jan-cerny/followers","following_url":"https://api.github.com/users/jan-cerny/following{/other_user}","gists_url":"https://api.github.com/users/jan-cerny/gists{/gist_id}","starred_url":"https://api.github.com/users/jan-cerny/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jan-cerny/subscriptions","organizations_url":"https://api.github.com/users/jan-cerny/orgs","repos_url":"https://api.github.com/users/jan-cerny/repos","events_url":"https://api.github.com/users/jan-cerny/events{/privacy}","received_events_url":"https://api.github.com/users/jan-cerny/received_events","type":"User","site_admin":false},"created_at":"2018-10-10T14:49:19Z","updated_at":"2018-10-10T14:49:19Z","author_association":"MEMBER","body":"Yes, we should definitely prefer the NIST CPEs, at the same time we shouldn't remove existing CPEs from maintenance branches. I agree with @mpreisler to be aware of this issue when reviewing PRs.\r\n\r\nThis is a more complex problem since some downstreams use unofficial CPEs in their content or os-release packages.\r\n\r\nWe are using `cpe:/o:redhat:enterprise_linux:7` to cover all RHEL7 minor releases, But NIST uses `cpe:/o:redhat:enterprise_linux:7_X` (where X is the minor version) different for every RHEL7 minor release.\r\n\r\nTo use official NIST CPEs in our content we would have to add official CPEs for every minor RHEL7 releases. Is that what we want?"}}
{"actor":{"display_login":"jan-cerny"}}