Skip to content

Regenerate stale tie scores and populate the Boundary Checks section - #2

Open
gronke wants to merge 2 commits into
FIRSTdotorg:mainfrom
gronke:fix/stale-tie-scores
Open

Regenerate stale tie scores and populate the Boundary Checks section#2
gronke wants to merge 2 commits into
FIRSTdotorg:mainfrom
gronke:fix/stale-tie-scores

Conversation

@gronke

@gronke gronke commented Jul 31, 2026

Copy link
Copy Markdown

Regenerates the score files against the reference calculator at RedHatProductSecurity/cvss-v4-calculator@d1eafe06 (the merge commit of the 2024-11-01 rounding fix, PR #67), and populates the empty Boundary Checks section.

  • 159 reference-scores and 1,412 base-threat-scores entries move up one tenth (x.x5 tie rounding); no severity changes. macro-scores is already correct and is untouched.
  • The 33 comment/blank lines in reference-scores that read Invalid vector string now mirror their vector-file counterparts, so the two files stay line-aligned without artifacts.
  • All 25,028 negative-test error entries are byte-for-byte untouched.
  • vectorFiles/regenerate_scores.mjs reproduces the score files against the sha256-pinned calculator revision; fetching cvss40.js at that revision is its only network access. On top of the calculator it enforces the eleven mandatory base metrics itself (the pinned revision accepts truncated vectors; reported upstream) and preserves existing error entries verbatim when it agrees a line is invalid.
  • Second commit (separable): reference-vectors gains the 522 Boundary Checks base vectors whose pre-rounded score sits at an x.x5 tie, with expected scores in the aligned lines of reference-scores. Verified against the pre-fix calculator at bea2884: every one of the 522 scores exactly 0.1 lower there, so any implementation without the rounding fix fails the whole section.

gronke added 2 commits July 30, 2026 13:22
The score files were generated before the calculator's 2024-11-01 rounding fix (RedHatProductSecurity/cvss-v4-calculator#67): scores whose pre-rounded value sits at an x.x5 tie rounded down instead of up.
159 reference entries and 1412 base-threat entries move up one tenth; severities are unaffected.
The 33 comment and blank lines in reference-scores previously read "Invalid vector string" and now mirror their vector-file counterparts.

regenerate_scores.mjs reproduces the files against the pinned fixed calculator; fetching that one file at its pinned revision is the script's only network access.
The 522 base vectors whose pre-rounded score sits at an x.x5 tie, with expected scores from the fixed calculator.
Any implementation without the 2024-11-01 rounding fix scores every one of these a tenth low, so the section now catches the class it was named for.
@gronke gronke changed the title Regenerate stale tie scores and populate the Boundary Checks section- #1 Regenerate stale tie scores and populate the Boundary Checks section Jul 31, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant