As I'm thinking about the implementation of a json builder for JulietSecurity/abom-advisories#1, it occurs to me that we'll have some duplication in the code, particularly the structs that define the format. Three approaches I see:
- Duplicate the code
- Have the abom-assembler pull from this repo in order to define the structs
- Move the struct definition to the abom-advisories repo and change abom to pull from there
- Add the json builder to abom proper
I don't like 4 because it combines the production and consumption. 1 is obviously not ideal in the long term, but it could work "for now" as it's the simplest approach.
2 and 3 are roughly the same. 3 feels a little more "right" to me because it keeps the definition of the advisory format with the advisory format.
I don't feel particularly strongly about any of these options (or a secret fifth option that you come up with), but I figured it was worth thinking about and coming to an explicit decision.
As I'm thinking about the implementation of a json builder for JulietSecurity/abom-advisories#1, it occurs to me that we'll have some duplication in the code, particularly the structs that define the format. Three approaches I see:
I don't like 4 because it combines the production and consumption. 1 is obviously not ideal in the long term, but it could work "for now" as it's the simplest approach.
2 and 3 are roughly the same. 3 feels a little more "right" to me because it keeps the definition of the advisory format with the advisory format.
I don't feel particularly strongly about any of these options (or a secret fifth option that you come up with), but I figured it was worth thinking about and coming to an explicit decision.