Overview:

This is a tracking issue for the work the Middleware team(s) and PSIRT will need to complete before work on using the security data can be estimated and begun.

Requirements:

• Changes to Middleware build+release processes designed
• Changes to Middleware build+release processes implemented
• Changes to VEX production designed (if needed)
• Changes to VEX production implemented (if needed)
• Documentation for detection and matching produced.

Technical Scope:

• Providing advice and consultation to design processes as needed.

Out of Scope:

• Any implementation work on ROX-31897.

Outstanding Questions:

It's currently unclear that our needs for the produced artifacts (self-identification) and VEX data (ordered versions) will be addressed.