as I stated in https://github.com/ossf/security-baseline/pull/427/files#r2565105191, when doing these mappings, I'd sort them into COMPLETE (coverage), PARTIAL (Coverage), SUPPORTS (as I feel the case is here), or N/A NONE (does not apply). If any of the 1st three states were triggered as I was doing my review, I'd "map" it. If we want to, we all could go back and refactor all of our mappings to show how strong the connection is to the framework under consideration. I'm unsure how that might complicate things, but if the team is interested in pursuing that, I certainly would be glad to contribute.
Originally posted by @SecurityCRob in #431 (comment)
as I stated in https://github.com/ossf/security-baseline/pull/427/files#r2565105191, when doing these mappings, I'd sort them into COMPLETE (coverage), PARTIAL (Coverage), SUPPORTS (as I feel the case is here), or N/A NONE (does not apply). If any of the 1st three states were triggered as I was doing my review, I'd "map" it. If we want to, we all could go back and refactor all of our mappings to show how strong the connection is to the framework under consideration. I'm unsure how that might complicate things, but if the team is interested in pursuing that, I certainly would be glad to contribute.
Originally posted by @SecurityCRob in #431 (comment)