Create JSON 5.0 Lint Tool

[rbrittonMitre]

Proposed New Idea/Feature

Usually, CVEs are confidential up to the time they are published "live" and instantiated in the CVE Corpus. If CNAs have incorporated the call to RSUS in their publishing tool, any JSON5 errors are flagged at the time of publication and then they have to be fixed and republished. This can add stress to an already stressful situation. It would be great to have a command line tool that would read the CVEs and flag any JSON5 errors external to the call to RSUS so that any inconsistencies can be addressed prior to the publication.

Such a tool would benefit many CNAs as it would allow them to identify JSON 5.0 errors prior to submitting them to RSUS saving them the time of having to attempt to publish only to fail because of a JSON syntax error.

[rbrittonMitre]

A prototype CVE Program JSON 5.0 Lint Tool is available at https://github.com/mprpic/cvelint.

[zmanion]

Is there further action to take here? Will the CVE Program develop a lint tool? Will we ask the community for more? I've used cvelint and would suggest that if there is need, interested parties work to improve cvelint.

[mprpic]

@jgamblin noted at today's AWG meeting that some folks were exploring ideas around linting/enhancing CVE records using an LLM. Jerry, got any details on this, or someone else who can provide them?

[jgamblin]

I am tracking this down and will try to get more information posted here soon.