Feature request: ignore query string in `$id`

[tschmidtb51]

As suggested by @jviotti in #672, here is a request from my experience with the tool:

Currently, it looks like there is 1:1 match regarding $ref to $id. However, e.g. the CVSS schemas (v2, v3.0, v3.1, v4.0) use the part after the ? to identify a version / last updated date. For CSAF, we want the latest version (assuming and trusting that FIRST CVSS SIG is just patching non-breaking stuff).

I did not see an option (especially on the command line) to ignore the query string / do a subpart matching or register a schema for a specific $id but maybe, I missed something. If you have that, please point me to the documentation, if not it would be my feature request...

[RitoG09]

A possible approach would be to introduce an optional resolution mode, for example:

• A CLI flag such as --ignore-query

Under this mode, the resolver could:

1. attempt exact $ref → $id matching first.
2. If no match is found, attempt a secondary lookup where the query component is stripped before comparison.
3. If multiple matches exist after stripping the query, fail deterministically with an exit code

@jviotti any thought on this?

[jviotti]

@tschmidtb51 @RitoG09 Interesting. The thing is that I don't think we can ignore the query, even with an option, without breaking compliance as per the standard, as the specification requires considering every aspect of the URI set as the identifier.

However, e.g. the CVSS schemas (v2, v3.0, v3.1, v4.0) use the part after the ? to identify a version / last updated date.

Well, even if we would support it, how would it work? Because if you --resolve them all, the ids will conflict (given we don't consider the fragment), unless we would do an extra lexicographic check on top of or something like that to support the new one...

Is this only needed from within your project? If so, maybe the jsonschema.json configuration manifest we have might help. If you put that at the root of your project, you can register id "renames" using the resolve option. Using the CLI in any subdirectory will automatically pick up the jsonschema.json. For example:

{
  "resolve": {
    "https://my-id-without-fragment": "./path/to/latest/cvss.json"
  }
}

So then if any schema inside any subdirectory reference https://my-id-without-fragment, the CLI will route it to the file ./path/to/latest/cvss.json.

Would that work?