What jsonschema version to use

[sthagen]

Given the fact, that draft 7 of jsonschema did expire in March 2020 we should analyze which version to settle on.

[tolim]

The latest version of JSON schema is 2019-09 (https://json-schema.org/draft/2019-09/release-notes.html). This is one release after draft 7, so we were only slightly outdated :-)
I propose to always settle on the latest version until we finalize our spec.

[sthagen]

Well, the links of the 2019-09 community pages towards the facet drafts at ietf are in part also expired since March ... maybe I can spare some energy to invest in contacting that project and understand as well as support - if welcome - their progress to a noramtively citable reference for a future OASIS Standard (CSAF v2.0). The current situation at that end I do not perceive as say, guaranteed.

I am in favor of following the components development we rely on - but I will investgate the practical aspect of validator implementations following the draft (or not) and possibly exposing errors in the new "dialects" they offer. If these validators are of equal quality I have no problem in us profiting from the enhancements of new json schema draft verisons.

Another aspect is the support for tool builders and API consumers: OpenAPI/Swagger/BakeMyAppFromThat-Service-providers are also an important aspect to include in the analysis. If draft-7 is good later this year for these interface builders but not the fresh stuff of say 2019-09, then we may profit from staying in the draft-7 regime and offer easily well known tooling helpers for our consumers.

Example: from the above OpenAPIv3 link:

OpenAPI 3 – the latest version of the OpenAPI Specification.
OpenAPI 3.0 uses an extended subset of JSON Schema Specification Wright Draft 00 (aka Draft 5) to describe the data formats. “Extended subset” means that some keywords are supported and some are not, some keywords have slightly different usage than in JSON Schema, and additional keywords are introduced.

[tschmidtb51]

I just had a look into the library we use for our tests: jsonschema has an open issue to support 2019-09: python-jsonschema/jsonschema#613

I suggest to revisit the issue before we publish to see the developments on the market. @sthagen mentioned a big point: support for tool builders and API consumers. If the users need to implement the JSON validator themselves instead of including a library - most of them won't do that. This would result in advisories which are incompatible with the schema.

[sthagen]

Updates from the JSON schema ecosystem:

• The JSON Schema community published on 2021-02-01 the new draft version 2020-12:
  • JSON Schema Core (2020-12) at https://json-schema.org/draft/2020-12/json-schema-core.html
  • JSON Schema Validation (2020-12) at https://json-schema.org/draft/2020-12/json-schema-validation.html
  • Relative JSON Pointers (2020-12) at https://json-schema.org/draft/2020-12/relative-json-pointer.html
• OpenAPI published version 3.1 on 2021-02-18 (cf. https://www.openapis.org/blog/2021/02/18/openapi-specification-3-1-released) and the exciting news is (citation from ibid):

  This new version now supports 100% compatibility with the latest draft (2020-12) of JSON Schema.

• Tools:
  • python jsonschema package has a ticket requesting support for 2020-12 draft at Support for v2020-12 and v2019 drafts python-jsonschema/jsonschema#782
  • python opens-i-core has a ticket requesting support for OpenAAPI 3.1 at Add support for OpenAPI v3.1 python-openapi/openapi-core#296

Maybe we can support the ecosystem to evolve fast enough for us to use the 2020-12 draft of JSON Schema and still have a first public review in summer (2021) ❤️

This would offer the following benefits / "guarantees":

1. users starting implementations of the CSAF JSON Schema get a fast start option via OpenAPI 3.1 based tools
2. CSAF v2.0 will be closer aligned with the evolving JSON Schema standardisation of the future
3. at least some open source tools for practical validation of CSAF documents are available

So, I second 👍 the proposal from @tolim to follow the JSON Schema draft versions (until we finalise our specification).

[tschmidtb51]

Also AJV support 2020-12: https://github.com/ajv-validator/ajv#features