For naming entities (persons in case of GitHub advisories), we use the login (for example credit.User.Login) because the full name may be missing. But GitHub logins can change and are not reliable as human-readable names.
Impact: CSAF acknowledgements may contain non-stable or non-human names, reducing clarity and future traceability.
Example in README:
|
| Publisher: Name | `user.login`, `user.name` | Single name | Use `login` because it is always set | |
Example in Code:
|
// We use the login as a name because it is required and the full name may be empty |
|
Names: []*string{&credit.User.Login}, |
For naming entities (persons in case of GitHub advisories), we use the login (for example
credit.User.Login) because the full name may be missing. But GitHub logins can change and are not reliable as human-readable names.Impact: CSAF acknowledgements may contain non-stable or non-human names, reducing clarity and future traceability.
Example in README:
ghsa/README.md
Line 62 in 0ac26d1
Example in Code:
ghsa/service/converter/document.go
Lines 54 to 55 in 0ac26d1