[PR] fix: ASF-wide CNA org id, never used for allocation; personal config in Subversion projects [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk opened a new pull request, #1779:
URL: https://github.com/apache/magpie/pull/1779

   Two problems an ASF PMC hit while trying Magpie for CVE work.
   
   ## The CNA org id is ASF-wide, and allocation never needs it
   
   The project template told every ASF adopter to fill in a per-project `asf_org_id`.
   The ASF CNA uses one UUID (`f0158376-9dc2-43b6-827c-5f631a4d8d09`) for every Apache project, and allocating a CVE does not use it at all.
   When asked where to find "its" value, the agent made up a dashboard page.
   
   - The UUID now lives in `organizations/ASF/organization.md` (`cve_authority.vulnogram.asf_org_id`); the per-project row is gone from the template and the manifests.
   - The allocation docs say allocation takes only the PMC and the title, and a test pins the `/allocatecve` form to those fields.
   - `generate-cve-json`, the one consumer, still requires `[cna].org_id`, now with a clear message instead of a `KeyError`.
     It deliberately has no default, so a project outside the ASF never gets the ASF UUID by omission.
   - Setup now settles `organization:` before sourcing ASF values: it proposes `ASF` only on evidence (an `apache/` GitHub remote, `.asf.yaml`, or a Subversion URL under `svn.apache.org`), and otherwise asks.
   
   ## Personal config in Subversion and non-VCS projects
   
   An unadopted project outside git had no personal layer, so Magpie refused to record or configure anything in a Subversion working copy.
   
   - A Subversion working copy keeps the layer in `<root>/.svn/apache-magpie/`: inside the admin directory, never committed, the same reasoning as `<git-common-dir>/apache-magpie/`.
     Only the project root's own `.svn` is accepted, never an ancestor's, as with `.git`.
   - A project with no version control keeps it in the in-tree `.apache-magpie-local/`.
   - The rule is applied to every copy of the shared layer resolver (the copy-match test enforces it), and the callers' "nowhere to keep it" branches are removed.
   
   Also bumps the dev version to `0.9.0.dev202610241347`.
   
   ## Test plan
   
   - [x] `prek run --all-files --skip workspace-pytest`
   - [x] `prek run workspace-pytest --from-ref <base> --to-ref HEAD`
   
   ---
   
   Generative AI disclosure: prepared with Claude Code (Opus 5.5) and reviewed by the author.
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix: ASF-wide CNA org id, never used for allocation; personal config in Subversion projects [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk merged PR #1779:
URL: https://github.com/apache/magpie/pull/1779


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org