feat: add test 6.2.19 for CSAF 2.0 by peinjoh · Pull Request #614 · csaf-rs/csaf

peinjoh · 2026-05-04T07:57:14Z

This PR adds test 6.2.19 for CSAF 2.0.

Resolves #135

Implementation has been extended to cover two different errors:
a) the "written out" property (CVSS v2, v3.0, v3.1 environmentalScore, CVSS v4 baseScore) are set to non-zero
b) the calculated score, based on the vector, and extending by the JSON where the vector has fields empty / NotDefined, is non-zero

This allows us to cleanly cover some edge cases where property and calculation don't match, but also leads us to emit two errors on "regular" documents, i.e. where property and calculation are both non-zero.

Copilot

Pull request overview

Adds and wires up validation 6.2.19 (CVSS for Fixed Products) for CSAF 2.0, ensuring products marked fixed/first_fixed only have CVSS metrics with an environmental score of 0.

Changes:

Added test_6_2_19 validator implementation and CSAF 2.0 testcases coverage.
Enabled the test_6_2_19 module and hooked it into CSAF 2.0’s run_test dispatch.
Added shared CVSS helper is_zero_score to support score comparisons.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.

File	Description
`csaf-rs/src/validations/test_6_2_19.rs`	New implementation of test 6.2.19 plus unit tests for CSAF 2.0 fixtures.
`csaf-rs/src/validations/mod.rs`	Exposes the new `test_6_2_19` module.
`csaf-rs/src/cvss/mod.rs`	Exposes `is_not_defined` and adds `is_zero_score` helper for score comparisons.
`csaf-rs/src/csaf2_0/validation.rs`	Enables execution of validator 6.2.19 for CSAF 2.0 documents.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

aschierl-xitaso · 2026-05-08T05:16:42Z

The vector CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N/MC:N/MI:N has a non-zero base score and an environmental score of 0.0, but is not accepted by this test...

github-actions

CSAF Validation Benchmark

Details

Benchmark suite	Current: `31b3d26`	Previous: `75d4c80`	Ratio
`csaf_2_0_tests/6.1.1`	`127314` ns/iter (`± 112`)	`133767` ns/iter (`± 592`)	`0.95`
`csaf_2_0_tests/6.1.2`	`51203` ns/iter (`± 193`)	`53338` ns/iter (`± 223`)	`0.96`
`csaf_2_0_tests/6.1.3`	`13407` ns/iter (`± 380`)	`13159` ns/iter (`± 54`)	`1.02`
`csaf_2_0_tests/6.1.4`	`28103` ns/iter (`± 46`)	`27830` ns/iter (`± 102`)	`1.01`
`csaf_2_0_tests/6.1.5`	`14000` ns/iter (`± 9`)	`14322` ns/iter (`± 21`)	`0.98`
`csaf_2_0_tests/6.1.6`	`39792` ns/iter (`± 64`)	`41962` ns/iter (`± 227`)	`0.95`
`csaf_2_0_tests/6.1.7`	`33832` ns/iter (`± 154`)	`35355` ns/iter (`± 65`)	`0.96`
`csaf_2_0_tests/6.1.8`	`90551` ns/iter (`± 312`)	`88495` ns/iter (`± 6191`)	`1.02`
`csaf_2_0_tests/6.1.9`	`66655` ns/iter (`± 3112`)	`68697` ns/iter (`± 975`)	`0.97`
`csaf_2_0_tests/6.1.10`	`156370` ns/iter (`± 927`)	`157325` ns/iter (`± 948`)	`0.99`
`csaf_2_0_tests/6.1.11`	`14296` ns/iter (`± 18`)	`14610` ns/iter (`± 150`)	`0.98`
`csaf_2_0_tests/6.1.12`	`30595` ns/iter (`± 62`)	`30106` ns/iter (`± 96`)	`1.02`
`csaf_2_0_tests/6.1.13`	`32857` ns/iter (`± 59`)	`32901` ns/iter (`± 208`)	`1.00`
`csaf_2_0_tests/6.1.14`	`68468` ns/iter (`± 219`)	`66613` ns/iter (`± 261`)	`1.03`
`csaf_2_0_tests/6.1.15`	`12561` ns/iter (`± 15`)	`13007` ns/iter (`± 76`)	`0.97`
`csaf_2_0_tests/6.1.16`	`49144` ns/iter (`± 40`)	`49610` ns/iter (`± 326`)	`0.99`
`csaf_2_0_tests/6.1.17`	`14380` ns/iter (`± 66`)	`14196` ns/iter (`± 96`)	`1.01`
`csaf_2_0_tests/6.1.18`	`16441` ns/iter (`± 57`)	`16576` ns/iter (`± 98`)	`0.99`
`csaf_2_0_tests/6.1.19`	`16049` ns/iter (`± 26`)	`16146` ns/iter (`± 18`)	`0.99`
`csaf_2_0_tests/6.1.20`	`14015` ns/iter (`± 73`)	`13905` ns/iter (`± 14`)	`1.01`
`csaf_2_0_tests/6.1.21`	`54273` ns/iter (`± 89`)	`53947` ns/iter (`± 356`)	`1.01`
`csaf_2_0_tests/6.1.22`	`63910` ns/iter (`± 409`)	`59667` ns/iter (`± 158`)	`1.07`
`csaf_2_0_tests/6.1.23`	`16597` ns/iter (`± 26`)	`17141` ns/iter (`± 252`)	`0.97`
`csaf_2_0_tests/6.1.24`	`15757` ns/iter (`± 30`)	`16169` ns/iter (`± 144`)	`0.97`
`csaf_2_0_tests/6.1.25`	`37109` ns/iter (`± 154`)	`36765` ns/iter (`± 523`)	`1.01`
`csaf_2_0_tests/6.1.26`	`20793` ns/iter (`± 51`)	`21092` ns/iter (`± 104`)	`0.99`
`csaf_2_0_tests/6.1.27.1`	`14127` ns/iter (`± 3537`)	`13812` ns/iter (`± 278`)	`1.02`
`csaf_2_0_tests/6.1.27.2`	`14216` ns/iter (`± 55`)	`13868` ns/iter (`± 64`)	`1.03`
`csaf_2_0_tests/6.1.27.3`	`13774` ns/iter (`± 11`)	`13376` ns/iter (`± 53`)	`1.03`
`csaf_2_0_tests/6.1.27.4`	`14117` ns/iter (`± 107`)	`13977` ns/iter (`± 173`)	`1.01`
`csaf_2_0_tests/6.1.27.5`	`14622` ns/iter (`± 20`)	`14561` ns/iter (`± 36`)	`1.00`
`csaf_2_0_tests/6.1.27.6`	`14008` ns/iter (`± 154`)	`14043` ns/iter (`± 149`)	`1.00`
`csaf_2_0_tests/6.1.27.7`	`13151` ns/iter (`± 54`)	`12979` ns/iter (`± 93`)	`1.01`
`csaf_2_0_tests/6.1.27.8`	`13143` ns/iter (`± 46`)	`13186` ns/iter (`± 17`)	`1.00`
`csaf_2_0_tests/6.1.27.9`	`26830` ns/iter (`± 86`)	`27124` ns/iter (`± 151`)	`0.99`
`csaf_2_0_tests/6.1.27.10`	`14813` ns/iter (`± 21`)	`14102` ns/iter (`± 113`)	`1.05`
`csaf_2_0_tests/6.1.27.11`	`13977` ns/iter (`± 28`)	`13368` ns/iter (`± 12`)	`1.05`
`csaf_2_0_tests/6.1.28`	`24364` ns/iter (`± 63`)	`24214` ns/iter (`± 20`)	`1.01`
`csaf_2_0_tests/6.1.29`	`12822` ns/iter (`± 40`)	`13041` ns/iter (`± 19`)	`0.98`
`csaf_2_0_tests/6.1.30`	`44389` ns/iter (`± 98`)	`43862` ns/iter (`± 47`)	`1.01`
`csaf_2_0_tests/6.1.31`	`35040` ns/iter (`± 87`)	`36597` ns/iter (`± 233`)	`0.96`
`csaf_2_0_tests/6.1.32`	`13440` ns/iter (`± 26`)	`13213` ns/iter (`± 31`)	`1.02`
`csaf_2_0_tests/6.1.33`	`19768` ns/iter (`± 104`)	`19881` ns/iter (`± 27`)	`0.99`
`csaf_2_0_tests/6.2.1`	`151530` ns/iter (`± 1153`)	`153048` ns/iter (`± 306`)	`0.99`
`csaf_2_0_tests/6.2.2`	`18049` ns/iter (`± 24`)	`18655` ns/iter (`± 52`)	`0.97`
`csaf_2_0_tests/6.2.3`	`16862` ns/iter (`± 17`)	`17613` ns/iter (`± 48`)	`0.96`
`csaf_2_0_tests/6.2.4`	`15971` ns/iter (`± 41`)	`16212` ns/iter (`± 26`)	`0.99`
`csaf_2_0_tests/6.2.5`	`56155` ns/iter (`± 39`)	`54953` ns/iter (`± 400`)	`1.02`
`csaf_2_0_tests/6.2.6`	`56443` ns/iter (`± 1672`)	`55662` ns/iter (`± 194`)	`1.01`
`csaf_2_0_tests/6.2.7`	`13252` ns/iter (`± 22`)	`13423` ns/iter (`± 17`)	`0.99`
`csaf_2_0_tests/6.2.8`	`34728` ns/iter (`± 53`)	`35425` ns/iter (`± 89`)	`0.98`
`csaf_2_0_tests/6.2.9`	`34876` ns/iter (`± 167`)	`34252` ns/iter (`± 82`)	`1.02`
`csaf_2_0_tests/6.2.10`	`39711` ns/iter (`± 50`)	`38526` ns/iter (`± 3146`)	`1.03`
`csaf_2_0_tests/6.2.11`	`171458` ns/iter (`± 517`)	`162977` ns/iter (`± 597`)	`1.05`
`csaf_2_0_tests/6.2.12`	`44416` ns/iter (`± 84`)	`44447` ns/iter (`± 77`)	`1.00`
`csaf_2_0_tests/6.2.13`	`845697` ns/iter (`± 3276`)	`832933` ns/iter (`± 4413`)	`1.02`
`csaf_2_0_tests/6.2.14`	`40711` ns/iter (`± 42`)	`41513` ns/iter (`± 103`)	`0.98`
`csaf_2_0_tests/6.2.15`	`32137` ns/iter (`± 43`)	`31600` ns/iter (`± 92`)	`1.02`
`csaf_2_0_tests/6.2.16`	`50991` ns/iter (`± 88`)	`52353` ns/iter (`± 356`)	`0.97`
`csaf_2_0_tests/6.2.17`	`13535` ns/iter (`± 10`)	`14505` ns/iter (`± 208`)	`0.93`
`csaf_2_0_tests/6.2.18`	`24541` ns/iter (`± 75`)	`24777` ns/iter (`± 54`)	`0.99`
`csaf_2_0_tests/6.2.19`	`50417` ns/iter (`± 73`)	`12647` ns/iter (`± 102`)	`3.99`
`csaf_2_0_tests/6.2.20`	`1694756` ns/iter (`± 4105`)	`1621755` ns/iter (`± 2769`)	`1.05`
`csaf_2_0_tests/6.3.1`	`36383` ns/iter (`± 57`)	`35331` ns/iter (`± 85`)	`1.03`
`csaf_2_0_tests/6.3.2`	`19782` ns/iter (`± 50`)	`21295` ns/iter (`± 45`)	`0.93`
`csaf_2_0_tests/6.3.3`	`23956` ns/iter (`± 71`)	`25044` ns/iter (`± 62`)	`0.96`
`csaf_2_0_tests/6.3.4`	`32959` ns/iter (`± 128`)	`34424` ns/iter (`± 267`)	`0.96`
`csaf_2_0_tests/6.3.5`	`36492` ns/iter (`± 123`)	`36251` ns/iter (`± 101`)	`1.01`
`csaf_2_0_tests/6.3.6`	`11625` ns/iter (`± 13`)	`12226` ns/iter (`± 40`)	`0.95`
`csaf_2_0_tests/6.3.7`	`11701` ns/iter (`± 15`)	`12230` ns/iter (`± 10`)	`0.96`
`csaf_2_0_tests/6.3.8`	`11990` ns/iter (`± 37`)	`12234` ns/iter (`± 18`)	`0.98`
`csaf_2_0_tests/6.3.9`	`28542` ns/iter (`± 65`)	`29348` ns/iter (`± 377`)	`0.97`
`csaf_2_0_tests/6.3.10`	`24553` ns/iter (`± 201`)	`25243` ns/iter (`± 191`)	`0.97`
`csaf_2_0_tests/6.3.11`	`25446` ns/iter (`± 66`)	`25852` ns/iter (`± 51`)	`0.98`
`csaf_2_1_tests/6.1.1`	`687303` ns/iter (`± 1516`)	`671887` ns/iter (`± 4650`)	`1.02`
`csaf_2_1_tests/6.1.2`	`256886` ns/iter (`± 7321`)	`262490` ns/iter (`± 1873`)	`0.98`
`csaf_2_1_tests/6.1.3`	`74586` ns/iter (`± 120`)	`74011` ns/iter (`± 92`)	`1.01`
`csaf_2_1_tests/6.1.4`	`134891` ns/iter (`± 1205`)	`131896` ns/iter (`± 403`)	`1.02`
`csaf_2_1_tests/6.1.5`	`53930` ns/iter (`± 76`)	`52187` ns/iter (`± 236`)	`1.03`
`csaf_2_1_tests/6.1.6`	`125008` ns/iter (`± 214`)	`124002` ns/iter (`± 258`)	`1.01`
`csaf_2_1_tests/6.1.7`	`164054` ns/iter (`± 725`)	`169669` ns/iter (`± 637`)	`0.97`
`csaf_2_1_tests/6.1.8`	`43662` ns/iter (`± 166`)	`43036` ns/iter (`± 247`)	`1.01`
`csaf_2_1_tests/6.1.9`	`514687` ns/iter (`± 1165`)	`512889` ns/iter (`± 1853`)	`1.00`
`csaf_2_1_tests/6.1.10`	`832343` ns/iter (`± 2990`)	`850362` ns/iter (`± 3509`)	`0.98`
`csaf_2_1_tests/6.1.11`	`67125` ns/iter (`± 202`)	`67750` ns/iter (`± 146`)	`0.99`
`csaf_2_1_tests/6.1.12`	`87447` ns/iter (`± 134`)	`85413` ns/iter (`± 160`)	`1.02`
`csaf_2_1_tests/6.1.13`	`200577` ns/iter (`± 679`)	`204082` ns/iter (`± 529`)	`0.98`
`csaf_2_1_tests/6.1.14`	`218767` ns/iter (`± 21860`)	`222249` ns/iter (`± 785`)	`0.98`
`csaf_2_1_tests/6.1.15`	`46677` ns/iter (`± 142`)	`45733` ns/iter (`± 433`)	`1.02`
`csaf_2_1_tests/6.1.16`	`159179` ns/iter (`± 265`)	`175191` ns/iter (`± 232`)	`0.91`
`csaf_2_1_tests/6.1.17`	`52646` ns/iter (`± 37`)	`52405` ns/iter (`± 699`)	`1.00`
`csaf_2_1_tests/6.1.18`	`57813` ns/iter (`± 242`)	`63339` ns/iter (`± 455`)	`0.91`
`csaf_2_1_tests/6.1.19`	`57065` ns/iter (`± 222`)	`60360` ns/iter (`± 625`)	`0.95`
`csaf_2_1_tests/6.1.20`	`52724` ns/iter (`± 76`)	`51371` ns/iter (`± 365`)	`1.03`
`csaf_2_1_tests/6.1.21`	`174820` ns/iter (`± 172`)	`179381` ns/iter (`± 676`)	`0.97`
`csaf_2_1_tests/6.1.22`	`194321` ns/iter (`± 269`)	`195626` ns/iter (`± 501`)	`0.99`
`csaf_2_1_tests/6.1.23`	`56855` ns/iter (`± 322`)	`56571` ns/iter (`± 293`)	`1.01`
`csaf_2_1_tests/6.1.24`	`54047` ns/iter (`± 49`)	`54236` ns/iter (`± 139`)	`1.00`
`csaf_2_1_tests/6.1.25`	`176711` ns/iter (`± 330`)	`177572` ns/iter (`± 322`)	`1.00`
`csaf_2_1_tests/6.1.26`	`78354` ns/iter (`± 795`)	`77031` ns/iter (`± 153`)	`1.02`
`csaf_2_1_tests/6.1.27.1`	`51383` ns/iter (`± 53`)	`50279` ns/iter (`± 61`)	`1.02`
`csaf_2_1_tests/6.1.27.2`	`51431` ns/iter (`± 312`)	`50425` ns/iter (`± 128`)	`1.02`
`csaf_2_1_tests/6.1.27.3`	`53092` ns/iter (`± 290`)	`51572` ns/iter (`± 137`)	`1.03`
`csaf_2_1_tests/6.1.27.4`	`53514` ns/iter (`± 66`)	`52076` ns/iter (`± 381`)	`1.03`
`csaf_2_1_tests/6.1.27.5`	`54182` ns/iter (`± 52`)	`52969` ns/iter (`± 227`)	`1.02`
`csaf_2_1_tests/6.1.27.6`	`53595` ns/iter (`± 85`)	`52259` ns/iter (`± 90`)	`1.03`
`csaf_2_1_tests/6.1.27.7`	`50399` ns/iter (`± 93`)	`49045` ns/iter (`± 311`)	`1.03`
`csaf_2_1_tests/6.1.27.8`	`50453` ns/iter (`± 287`)	`48820` ns/iter (`± 75`)	`1.03`
`csaf_2_1_tests/6.1.27.9`	`72285` ns/iter (`± 368`)	`70332` ns/iter (`± 131`)	`1.03`
`csaf_2_1_tests/6.1.27.10`	`51373` ns/iter (`± 50`)	`49621` ns/iter (`± 114`)	`1.04`
`csaf_2_1_tests/6.1.27.11`	`53964` ns/iter (`± 50`)	`51093` ns/iter (`± 356`)	`1.06`
`csaf_2_1_tests/6.1.27.12`	`54343` ns/iter (`± 74`)	`51184` ns/iter (`± 106`)	`1.06`
`csaf_2_1_tests/6.1.27.13`	`43948` ns/iter (`± 83`)	`41381` ns/iter (`± 67`)	`1.06`
`csaf_2_1_tests/6.1.27.14`	`53125` ns/iter (`± 112`)	`51597` ns/iter (`± 480`)	`1.03`
`csaf_2_1_tests/6.1.27.15`	`52864` ns/iter (`± 48`)	`50996` ns/iter (`± 90`)	`1.04`
`csaf_2_1_tests/6.1.27.16`	`53902` ns/iter (`± 147`)	`51200` ns/iter (`± 279`)	`1.05`
`csaf_2_1_tests/6.1.27.17`	`56813` ns/iter (`± 283`)	`55490` ns/iter (`± 125`)	`1.02`
`csaf_2_1_tests/6.1.27.18`	`59901` ns/iter (`± 123`)	`58235` ns/iter (`± 45`)	`1.03`
`csaf_2_1_tests/6.1.27.19`	`57762` ns/iter (`± 119`)	`56028` ns/iter (`± 308`)	`1.03`
`csaf_2_1_tests/6.1.28`	`76674` ns/iter (`± 424`)	`71739` ns/iter (`± 1070`)	`1.07`
`csaf_2_1_tests/6.1.29`	`49559` ns/iter (`± 782`)	`49365` ns/iter (`± 85`)	`1.00`
`csaf_2_1_tests/6.1.30`	`152228` ns/iter (`± 512`)	`165939` ns/iter (`± 1948`)	`0.92`
`csaf_2_1_tests/6.1.31`	`171124` ns/iter (`± 188`)	`174525` ns/iter (`± 393`)	`0.98`
`csaf_2_1_tests/6.1.32`	`49282` ns/iter (`± 236`)	`49712` ns/iter (`± 120`)	`0.99`
`csaf_2_1_tests/6.1.33`	`46680` ns/iter (`± 53`)	`45245` ns/iter (`± 293`)	`1.03`
`csaf_2_1_tests/6.1.34`	`60372` ns/iter (`± 146`)	`60640` ns/iter (`± 191`)	`1.00`
`csaf_2_1_tests/6.1.35`	`80402` ns/iter (`± 475`)	`82248` ns/iter (`± 201`)	`0.98`
`csaf_2_1_tests/6.1.36`	`46380` ns/iter (`± 43`)	`45962` ns/iter (`± 242`)	`1.01`
`csaf_2_1_tests/6.1.37`	`46081` ns/iter (`± 61`)	`46278` ns/iter (`± 76`)	`1.00`
`csaf_2_1_tests/6.1.38`	`49375` ns/iter (`± 43`)	`48321` ns/iter (`± 231`)	`1.02`
`csaf_2_1_tests/6.1.39`	`49201` ns/iter (`± 124`)	`48835` ns/iter (`± 109`)	`1.01`
`csaf_2_1_tests/6.1.40`	`48378` ns/iter (`± 49`)	`48583` ns/iter (`± 94`)	`1.00`
`csaf_2_1_tests/6.1.41`	`49663` ns/iter (`± 112`)	`49073` ns/iter (`± 2368`)	`1.01`
`csaf_2_1_tests/6.1.42`	`210753` ns/iter (`± 1226`)	`217439` ns/iter (`± 771`)	`0.97`
`csaf_2_1_tests/6.1.43`	`174050` ns/iter (`± 280`)	`177053` ns/iter (`± 659`)	`0.98`
`csaf_2_1_tests/6.1.44`	`175229` ns/iter (`± 448`)	`181351` ns/iter (`± 4734`)	`0.97`
`csaf_2_1_tests/6.1.45`	`170841` ns/iter (`± 299`)	`175870` ns/iter (`± 1161`)	`0.97`
`csaf_2_1_tests/6.1.46`	`275658` ns/iter (`± 597`)	`285247` ns/iter (`± 1306`)	`0.97`
`csaf_2_1_tests/6.1.47`	`417015` ns/iter (`± 2349`)	`448465` ns/iter (`± 2536`)	`0.93`
`csaf_2_1_tests/6.1.48`	`48568` ns/iter (`± 50`)	`48791` ns/iter (`± 115`)	`1.00`
`csaf_2_1_tests/6.1.49`	`48909` ns/iter (`± 64`)	`49014` ns/iter (`± 42`)	`1.00`
`csaf_2_1_tests/6.1.50`	`48896` ns/iter (`± 59`)	`49256` ns/iter (`± 197`)	`0.99`
`csaf_2_1_tests/6.1.51`	`176659` ns/iter (`± 394`)	`181525` ns/iter (`± 924`)	`0.97`
`csaf_2_1_tests/6.1.52`	`181601` ns/iter (`± 523`)	`183296` ns/iter (`± 1031`)	`0.99`
`csaf_2_1_tests/6.1.53`	`56879` ns/iter (`± 191`)	`57017` ns/iter (`± 135`)	`1.00`
`csaf_2_1_tests/6.1.54`	`65706` ns/iter (`± 47`)	`66218` ns/iter (`± 427`)	`0.99`
`csaf_2_1_tests/6.1.55`	`66956` ns/iter (`± 132`)	`73290` ns/iter (`± 1473`)	`0.91`
`csaf_2_1_tests/6.1.56`	`97706` ns/iter (`± 208`)	`101574` ns/iter (`± 351`)	`0.96`
`csaf_2_1_tests/6.1.57`	`137928` ns/iter (`± 362`)	`133792` ns/iter (`± 1067`)	`1.03`
`csaf_2_1_tests/6.1.58`	`88393` ns/iter (`± 273`)	`92121` ns/iter (`± 650`)	`0.96`
`csaf_2_1_tests/6.1.59`	`51316` ns/iter (`± 46`)	`52232` ns/iter (`± 194`)	`0.98`
`csaf_2_1_tests/6.1.60.1`	`43950` ns/iter (`± 53`)	`42482` ns/iter (`± 386`)	`1.03`
`csaf_2_1_tests/6.1.60.2`	`43648` ns/iter (`± 151`)	`42476` ns/iter (`± 127`)	`1.03`
`csaf_2_1_tests/6.1.60.3`	`43939` ns/iter (`± 40`)	`42768` ns/iter (`± 152`)	`1.03`
`csaf_2_1_tests/6.1.61`	`176916` ns/iter (`± 424`)	`187771` ns/iter (`± 876`)	`0.94`
`csaf_2_1_tests/6.2.1`	`752675` ns/iter (`± 4218`)	`724671` ns/iter (`± 2145`)	`1.04`
`csaf_2_1_tests/6.2.2`	`73992` ns/iter (`± 389`)	`75141` ns/iter (`± 519`)	`0.98`
`csaf_2_1_tests/6.2.3`	`69157` ns/iter (`± 291`)	`69805` ns/iter (`± 191`)	`0.99`
`csaf_2_1_tests/6.2.4`	`59168` ns/iter (`± 69`)	`60735` ns/iter (`± 96`)	`0.97`
`csaf_2_1_tests/6.2.5`	`190098` ns/iter (`± 982`)	`204365` ns/iter (`± 1971`)	`0.93`
`csaf_2_1_tests/6.2.6`	`194750` ns/iter (`± 1459`)	`211113` ns/iter (`± 2890`)	`0.92`
`csaf_2_1_tests/6.2.7`	`50574` ns/iter (`± 82`)	`50008` ns/iter (`± 111`)	`1.01`
`csaf_2_1_tests/6.2.8`	`173152` ns/iter (`± 232`)	`178031` ns/iter (`± 862`)	`0.97`
`csaf_2_1_tests/6.2.9`	`171645` ns/iter (`± 405`)	`181570` ns/iter (`± 993`)	`0.95`
`csaf_2_1_tests/6.2.11`	`624507` ns/iter (`± 1588`)	`616446` ns/iter (`± 1502`)	`1.01`
`csaf_2_1_tests/6.2.12`	`167039` ns/iter (`± 306`)	`168934` ns/iter (`± 320`)	`0.99`
`csaf_2_1_tests/6.2.13`	`3852018` ns/iter (`± 10002`)	`3726892` ns/iter (`± 44552`)	`1.03`
`csaf_2_1_tests/6.2.14`	`114581` ns/iter (`± 62`)	`118411` ns/iter (`± 356`)	`0.97`
`csaf_2_1_tests/6.2.15`	`95908` ns/iter (`± 176`)	`95123` ns/iter (`± 149`)	`1.01`
`csaf_2_1_tests/6.2.16`	`253441` ns/iter (`± 1240`)	`273192` ns/iter (`± 2570`)	`0.93`
`csaf_2_1_tests/6.2.17`	`58169` ns/iter (`± 81`)	`59497` ns/iter (`± 609`)	`0.98`
`csaf_2_1_tests/6.2.18`	`144292` ns/iter (`± 650`)	`150944` ns/iter (`± 945`)	`0.96`
`csaf_2_1_tests/6.2.19`	`56107` ns/iter (`± 69`)	`53657` ns/iter (`± 61`)	`1.05`
`csaf_2_1_tests/6.2.20`	`9195045` ns/iter (`± 76526`)	`9759262` ns/iter (`± 486225`)	`0.94`
`csaf_2_1_tests/6.2.21`	`368006` ns/iter (`± 574`)	`385909` ns/iter (`± 13893`)	`0.95`
`csaf_2_1_tests/6.2.22`	`155030` ns/iter (`± 230`)	`168876` ns/iter (`± 1568`)	`0.92`
`csaf_2_1_tests/6.2.23`	`72273` ns/iter (`± 205`)	`74927` ns/iter (`± 4154`)	`0.96`
`csaf_2_1_tests/6.2.24`	`237392` ns/iter (`± 377`)	`230544` ns/iter (`± 1577`)	`1.03`
`csaf_2_1_tests/6.2.25`	`73920` ns/iter (`± 131`)	`75354` ns/iter (`± 157`)	`0.98`
`csaf_2_1_tests/6.2.26`	`74237` ns/iter (`± 174`)	`74866` ns/iter (`± 995`)	`0.99`
`csaf_2_1_tests/6.2.27`	`56085` ns/iter (`± 145`)	`54996` ns/iter (`± 143`)	`1.02`
`csaf_2_1_tests/6.2.28`	`59599` ns/iter (`± 79`)	`59115` ns/iter (`± 523`)	`1.01`
`csaf_2_1_tests/6.2.29`	`59270` ns/iter (`± 79`)	`57930` ns/iter (`± 528`)	`1.02`
`csaf_2_1_tests/6.2.30`	`62694` ns/iter (`± 69`)	`59829` ns/iter (`± 422`)	`1.05`
`csaf_2_1_tests/6.2.31`	`206919` ns/iter (`± 306`)	`218436` ns/iter (`± 677`)	`0.95`
`csaf_2_1_tests/6.2.32`	`319475` ns/iter (`± 1737`)	`322092` ns/iter (`± 1618`)	`0.99`
`csaf_2_1_tests/6.2.33`	`224472` ns/iter (`± 561`)	`244110` ns/iter (`± 419`)	`0.92`
`csaf_2_1_tests/6.2.34`	`484148` ns/iter (`± 6445`)	`619267` ns/iter (`± 1627`)	`0.78`
`csaf_2_1_tests/6.2.35`	`430480` ns/iter (`± 5082`)	`537184` ns/iter (`± 5676`)	`0.80`
`csaf_2_1_tests/6.2.36`	`443061` ns/iter (`± 1758`)	`548845` ns/iter (`± 4757`)	`0.81`
`csaf_2_1_tests/6.2.37`	`462184` ns/iter (`± 1734`)	`590078` ns/iter (`± 7251`)	`0.78`
`csaf_2_1_tests/6.2.38`	`88531` ns/iter (`± 174`)	`86559` ns/iter (`± 6225`)	`1.02`
`csaf_2_1_tests/6.2.39.1`	`44882` ns/iter (`± 58`)	`42754` ns/iter (`± 714`)	`1.05`
`csaf_2_1_tests/6.2.39.2`	`55800` ns/iter (`± 100`)	`54061` ns/iter (`± 530`)	`1.03`
`csaf_2_1_tests/6.2.39.3`	`58398` ns/iter (`± 155`)	`57046` ns/iter (`± 715`)	`1.02`
`csaf_2_1_tests/6.2.39.4`	`44542` ns/iter (`± 93`)	`43022` ns/iter (`± 66`)	`1.04`
`csaf_2_1_tests/6.2.39.5`	`44798` ns/iter (`± 158`)	`43327` ns/iter (`± 115`)	`1.03`
`csaf_2_1_tests/6.2.40`	`59151` ns/iter (`± 73`)	`57958` ns/iter (`± 261`)	`1.02`
`csaf_2_1_tests/6.2.41`	`191074` ns/iter (`± 315`)	`195785` ns/iter (`± 1195`)	`0.98`
`csaf_2_1_tests/6.2.42`	`59618` ns/iter (`± 61`)	`58966` ns/iter (`± 206`)	`1.01`
`csaf_2_1_tests/6.2.43`	`59912` ns/iter (`± 97`)	`59211` ns/iter (`± 75`)	`1.01`
`csaf_2_1_tests/6.2.44`	`60256` ns/iter (`± 66`)	`59431` ns/iter (`± 129`)	`1.01`
`csaf_2_1_tests/6.2.45`	`60500` ns/iter (`± 164`)	`59631` ns/iter (`± 129`)	`1.01`
`csaf_2_1_tests/6.2.46`	`60826` ns/iter (`± 96`)	`59873` ns/iter (`± 454`)	`1.02`
`csaf_2_1_tests/6.2.47`	`308661` ns/iter (`± 1846`)	`294404` ns/iter (`± 2453`)	`1.05`
`csaf_2_1_tests/6.2.48`	`155901` ns/iter (`± 411`)	`163492` ns/iter (`± 1366`)	`0.95`
`csaf_2_1_tests/6.2.49`	`61453` ns/iter (`± 85`)	`60605` ns/iter (`± 113`)	`1.01`
`csaf_2_1_tests/6.2.50.1`	`44551` ns/iter (`± 320`)	`43018` ns/iter (`± 272`)	`1.04`
`csaf_2_1_tests/6.2.50.2`	`44343` ns/iter (`± 359`)	`42953` ns/iter (`± 457`)	`1.03`
`csaf_2_1_tests/6.2.50.3`	`45546` ns/iter (`± 102`)	`43270` ns/iter (`± 41`)	`1.05`
`csaf_2_1_tests/6.2.51`	`61777` ns/iter (`± 78`)	`60919` ns/iter (`± 130`)	`1.01`
`csaf_2_1_tests/6.2.52`	`192318` ns/iter (`± 754`)	`200552` ns/iter (`± 1150`)	`0.96`
`csaf_2_1_tests/6.2.53`	`72460` ns/iter (`± 113`)	`68277` ns/iter (`± 308`)	`1.06`
`csaf_2_1_tests/6.2.54.1`	`44581` ns/iter (`± 149`)	`43296` ns/iter (`± 207`)	`1.03`
`csaf_2_1_tests/6.2.54.2`	`44264` ns/iter (`± 69`)	`43263` ns/iter (`± 399`)	`1.02`
`csaf_2_1_tests/6.2.54.3`	`44844` ns/iter (`± 134`)	`43280` ns/iter (`± 518`)	`1.04`
`csaf_2_1_tests/6.2.54.4`	`44842` ns/iter (`± 40`)	`43286` ns/iter (`± 259`)	`1.04`
`csaf_2_1_tests/6.3.1`	`45259` ns/iter (`± 278`)	`44137` ns/iter (`± 72`)	`1.03`
`csaf_2_1_tests/6.3.2`	`72964` ns/iter (`± 197`)	`75802` ns/iter (`± 199`)	`0.96`
`csaf_2_1_tests/6.3.3`	`46097` ns/iter (`± 78`)	`44627` ns/iter (`± 146`)	`1.03`
`csaf_2_1_tests/6.3.4`	`45416` ns/iter (`± 70`)	`44738` ns/iter (`± 228`)	`1.02`
`csaf_2_1_tests/6.3.5`	`45456` ns/iter (`± 58`)	`44455` ns/iter (`± 177`)	`1.02`
`csaf_2_1_tests/6.3.6`	`45784` ns/iter (`± 79`)	`44614` ns/iter (`± 77`)	`1.03`
`csaf_2_1_tests/6.3.7`	`45605` ns/iter (`± 285`)	`45464` ns/iter (`± 297`)	`1.00`
`csaf_2_1_tests/6.3.8`	`45779` ns/iter (`± 370`)	`45719` ns/iter (`± 146`)	`1.00`
`csaf_2_1_tests/6.3.9`	`161482` ns/iter (`± 339`)	`171828` ns/iter (`± 400`)	`0.94`
`csaf_2_1_tests/6.3.10`	`62614` ns/iter (`± 292`)	`61135` ns/iter (`± 102`)	`1.02`
`csaf_2_1_tests/6.3.11`	`62830` ns/iter (`± 55`)	`61851` ns/iter (`± 656`)	`1.02`
`csaf_2_1_tests/6.3.12`	`216700` ns/iter (`± 255`)	`232430` ns/iter (`± 685`)	`0.93`
`csaf_2_1_tests/6.3.13`	`63427` ns/iter (`± 262`)	`62382` ns/iter (`± 42`)	`1.02`
`csaf_2_1_tests/6.3.14`	`125375` ns/iter (`± 362`)	`124202` ns/iter (`± 1645`)	`1.01`
`csaf_2_1_tests/6.3.15`	`125662` ns/iter (`± 136`)	`123231` ns/iter (`± 1148`)	`1.02`
`csaf_2_1_tests/6.3.16`	`64114` ns/iter (`± 699`)	`63190` ns/iter (`± 87`)	`1.01`
`csaf_2_1_tests/6.3.17`	`64438` ns/iter (`± 96`)	`63358` ns/iter (`± 589`)	`1.02`
`csaf_2_1_tests/6.3.18`	`74905` ns/iter (`± 339`)	`78451` ns/iter (`± 654`)	`0.95`
`csaf_2_1_tests/6.3.19.1`	`44531` ns/iter (`± 30`)	`43247` ns/iter (`± 303`)	`1.03`
`csaf_2_1_tests/6.3.19.2`	`45182` ns/iter (`± 353`)	`43280` ns/iter (`± 82`)	`1.04`
`csaf_2_1_tests/6.3.19.3`	`45414` ns/iter (`± 280`)	`43280` ns/iter (`± 215`)	`1.05`
`csaf_2_1_tests/6.3.19.4`	`44587` ns/iter (`± 239`)	`43308` ns/iter (`± 177`)	`1.03`
`csaf_2_1_tests/6.3.19.5`	`45180` ns/iter (`± 125`)	`43280` ns/iter (`± 118`)	`1.04`
`csaf_2_1_tests/6.3.20`	`76904` ns/iter (`± 128`)	`76611` ns/iter (`± 111`)	`1.00`
`csaf_2_1_tests/6.3.21.1`	`45458` ns/iter (`± 289`)	`43264` ns/iter (`± 48`)	`1.05`
`csaf_2_1_tests/6.3.21.2`	`44821` ns/iter (`± 84`)	`43291` ns/iter (`± 46`)	`1.04`
`csaf_2_1_tests/6.3.21.3`	`45470` ns/iter (`± 104`)	`43302` ns/iter (`± 95`)	`1.05`
`csaf_2_1_tests/6.3.21.4`	`44830` ns/iter (`± 34`)	`43237` ns/iter (`± 500`)	`1.04`
`csaf_2_1_tests/6.3.21.5`	`44855` ns/iter (`± 59`)	`43299` ns/iter (`± 105`)	`1.04`
`csaf_2_1_tests/6.3.21.6`	`44855` ns/iter (`± 1421`)	`43286` ns/iter (`± 43`)	`1.04`
`csaf_2_1_tests/6.3.21.7`	`45487` ns/iter (`± 48`)	`43297` ns/iter (`± 116`)	`1.05`
`csaf_2_1_tests/6.3.21.8`	`44828` ns/iter (`± 146`)	`43253` ns/iter (`± 187`)	`1.04`
`csaf_2_1_tests/6.3.21.9`	`44845` ns/iter (`± 252`)	`43241` ns/iter (`± 403`)	`1.04`
`csaf_2_1_tests/6.3.22`	`65309` ns/iter (`± 67`)	`64133` ns/iter (`± 181`)	`1.02`
`full_validation/csaf_2_0_full_preset`	`7458742` ns/iter (`± 13746`)	`7778599` ns/iter (`± 66973`)	`0.96`
`full_validation/csaf_2_1_full_preset`	`51731414` ns/iter (`± 165940`)	`58456705` ns/iter (`± 332881`)	`0.88`
`parse_only/csaf_2_0`	`1147295` ns/iter (`± 1338`)	`1149669` ns/iter (`± 23520`)	`1.00`
`parse_only/csaf_2_1`	`5810982` ns/iter (`± 12597`)	`5699929` ns/iter (`± 49004`)	`1.02`
`typed_parse/csaf_2_0`	`1965385` ns/iter (`± 2640`)	`2000839` ns/iter (`± 9132`)	`0.98`
`typed_parse/csaf_2_1`	`9485591` ns/iter (`± 21065`)	`9476768` ns/iter (`± 43825`)	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

github-actions

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'CSAF Validation Benchmark'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.50.

Benchmark suite	Current: `31b3d26`	Previous: `75d4c80`	Ratio
`csaf_2_0_tests/6.2.19`	`50417` ns/iter (`± 73`)	`12647` ns/iter (`± 102`)	`3.99`

This comment was automatically generated by workflow using github-action-benchmark.

# Conflicts: # type-generator/assets/tests/csaf_2.1/testcases.json

peinjoh · 2026-08-26T11:57:37Z

The vector CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N/MC:N/MI:N has a non-zero base score and an environmental score of 0.0, but is not accepted by this test...

This is a supplemental testcase now, and correctly handled

Copilot

Pull request overview

Copilot reviewed 32 out of 32 changed files in this pull request and generated 2 comments.

+    if effective.target_distribution.as_ref().is_none_or(is_not_defined)
+        && cvss_v2.target_distribution.as_ref().is_some_and(|v| !is_not_defined(v))
+    {
+        effective.target_distribution = cvss_v2.target_distribution;
+    }


aschierl-xitaso · 2026-08-26T17:14:52Z

+    let mut results = Vec::new();
+
    // an explicitly reported overall score is authoritative
    if is_zero_score(cvss_v4.base_score) {


What value is stored in the baseScore property of a CVSS v4 JSON? (as there is no longer Temporal Score or Environmental Score in the JSON format, while it's still there in the XML format).
Unfortunately, https://www.first.org/cvss/data-representations does not give a clear indication there.

Is it the overall score (CVSS-BTE) or just the non-modified (CVSS-B) one?
This is probably also relevant to test 6.1.9 (where - as far as I know - we currently assume CVSS-BTE).

@tschmidtb51 Do you have insights or an opinion there?

tschmidtb51 · 2026-08-26T23:06:01Z

Theoretically, there is only the overall score (which is stored in the baseScore value) as all data points are inserted (but the ones in environmental and threat groups use default if not set).

aschierl-xitaso · 2026-08-27T09:58:39Z


-    // JSON-provided environmental properties take precedence over the vector string
-    if cvss_v3.modified_confidentiality_impact.is_some() {
+    // JSON-provided environmental properties supplement the vector, if the vector does not have


I'd expect so see similar code in tests 6.1.9, probably it makes sense to extract it.

peinjoh requested a review from a team as a code owner May 4, 2026 07:57

peinjoh requested a review from Copilot May 4, 2026 07:57

Copilot started reviewing on behalf of peinjoh May 4, 2026 07:58 View session

Copilot AI reviewed May 4, 2026

View reviewed changes

peinjoh requested a review from Copilot May 4, 2026 08:41

Copilot started reviewing on behalf of peinjoh May 4, 2026 08:42 View session

Copilot AI reviewed May 4, 2026

View reviewed changes

Comment thread csaf-rs/src/validations/test_6_2_19.rs Outdated

Comment thread csaf-rs/src/validations/test_6_2_19.rs

Comment thread csaf-rs/src/validations/test_6_2_19.rs

Comment thread csaf-rs/src/cvss/mod.rs Outdated

Comment thread csaf-rs/src/cvss/mod.rs Outdated

peinjoh marked this pull request as draft May 18, 2026 13:06

tziemek force-pushed the feat/test-6-2-19-for-csaf-20 branch from 4dfdc6a to 99dec02 Compare July 22, 2026 08:57

peinjoh and others added 6 commits July 28, 2026 17:06

feat: add test 6.2.19 for CSAF 2.0

aeb128c

fix: fmt and clippy

a00871e

fix: clippy

f9e6fd0

fix: cr comments

cac8063

fix: cr comments

2ea6e0e

fix as_str usage on product_id

553d574

tziemek force-pushed the feat/test-6-2-19-for-csaf-20 branch from 99dec02 to 553d574 Compare July 28, 2026 15:06

github-actions Bot reviewed Jul 28, 2026

View reviewed changes

tziemek and others added 11 commits July 29, 2026 11:01

rework errors

daf85dc

add cvss_4

68958f2

fix some bugs

5cdf245

fix json

021dcc4

Merge branch 'main' into feat/test-6-2-19-for-csaf-20

e85f112

# Conflicts: # type-generator/assets/tests/csaf_2.1/testcases.json

fix: correct test

e4724f5

fix: correct test data

a375090

feat: add prop score zero suppl test cases for CSAF 2.0

41d92c7

feat: add prop score zero suppl test cases for CSAF 2.1

45ee72a

feat: refactor CSAF 2.0 to return both erros

4019cac

feat: more 2.0 tests

ffe668d

peinjoh added 3 commits August 26, 2026 13:32

feat: fix for CSAF 2.1

c85ccfe

fix: align test naming

a632cc4

fix: wrong reported result

c39ecaa

peinjoh requested a balanced review from Copilot August 26, 2026 11:56

Copilot started reviewing on behalf of peinjoh August 26, 2026 11:57 View session

Merge branch 'main' into feat/test-6-2-19-for-csaf-20

31b3d26

Copilot AI reviewed Aug 26, 2026

View reviewed changes

aschierl-xitaso reviewed Aug 26, 2026

View reviewed changes

aschierl-xitaso reviewed Aug 27, 2026

View reviewed changes

peinjoh mentioned this pull request Sep 14, 2026

feat: add test 6.1.8 for CSAF 2.1 #969

Merged

Conversation

peinjoh commented May 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

aschierl-xitaso commented May 8, 2026

Uh oh!

github-actions Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

CSAF Validation Benchmark

Uh oh!

github-actions Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

⚠️ Performance Alert ⚠️

Uh oh!

peinjoh commented Aug 26, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

aschierl-xitaso Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aschierl-xitaso Aug 26, 2026

Choose a reason for hiding this comment

Uh oh!

tschmidtb51 commented Aug 26, 2026 via email

Uh oh!

aschierl-xitaso Aug 27, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

peinjoh commented May 4, 2026 •

edited

Loading

github-actions Bot left a comment •

edited

Loading

github-actions Bot left a comment •

edited

Loading

aschierl-xitaso Aug 26, 2026 •

edited

Loading