Add Vulnerability Exchange (VEX) statements for CPython SBOMs to reference

Open
#2,340 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
25/100
Issue type
Feature
Clarity
Needs clarification
Activity status
Stale
Tech stack
github, python
Domain
security

Research direction

Start by reading the related CPython issue 112302 and compare the proposed OpenVEX and CycloneDX formats. Define how VEX documents would reference CPython SBOM dependencies, be hosted at an HTTPS location, and be updated through GitHub pull requests; completion requires a documented format and contribution workflow.

Written by the indexing model from the issue text.

Description

app/downloads enhancement needs-feedback security

Part of https://github.com/python/cpython/issues/112302

Is your feature request related to a problem? Please describe.

CPython and its artifacts contain many dependencies which can have vulnerabilities. In the interest of not causing mass-confusion from SBOM consumers about the status of the vulnerabilities in dependencies (especially when those vulnerabilities aren't exploitable, like is usually the case for CPython's usage of OpenSSL) it is useful to provide a systematic and automatic mechanism to quell SBOM consumers questions on a potentially vulnerable component.

Describe the solution you'd like

  • VEX document(s) which are capable of referencing dependencies inside of CPython SBOMs and making determinations about affectedness of vulnerabilities.
  • Need to evaluate VEX formats (OpenVEX and CycloneDX are my current candidates)
  • Referenceable location (via HTTPS) so that CPython SBOMs can reference the document(s)
  • Easy way to update the VEX documents via GitHub PR process. Should be easy to contribute so core developers can do so when needed.
Dominant language
Python
Stars
1.7k
Forks
700
Avg merge
1d 23h
Merged PRs (30d)
14

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from python/pythondotorg

All issues in python/pythondotorg

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.