Add EPSS and other scoring systems that leverage measurements rather than scores.

[stevespringett]

Closes #481

[Mehrn0ush]

Nice. Named measures plus methodVersion and timestamp answers the concerns in #481 without hard-coding EPSS's current fields, and forbidding score for EPSS keeps probabilities from being mixed with severity scores.

Suggestions I left as inline comments:

1. confidence is in meta:enum but not in the enum, which probably explains the red test 2.0 job.
2. For EPSS, also require measures with a probability, and consider requiring timestamp.
3. Define timestamp as when the method produced the score (the EPSS score date), not when it was retrieved.
4. Bound probability, percentile, and confidence to 0–1.
5. Say that measure names are unique within a rating.

[Mehrn0ush]

The EPSS conditional forbids score but requires nothing! An EPSS rating can omit both measurements and timing. This stops EPSS from using score, but { "method": "EPSS" } with no measures is still valid, and so is an EPSS rating with no timestamp. Given the concerns in #481, could the then branch also require measures containing a probability, and possibly a timestamp?

"then": {
  "not": { "required": ["score"] },
  "required": ["measures", "timestamp"],
  "properties": {
    "measures": { "contains": { "properties": { "name": { "const": "probability" } }, "required": ["name"] } }
  }
} 

If requiring timestamp is too strict, a "should" in the description would still help.

[stevespringett]

Lets refine this after the merge.

[Mehrn0ush]

"Produced or observed" covers two different times. For EPSS, FIRST publishes a score for a given date, and a scanner may retrieve it days later. Consumers need the first to judge freshness.
The date and time the method produced this rating. For methods published on a schedule, this is the date of the published score, not the time it was retrieved.

[Mehrn0ush]

meta:enum says probability and percentile are decimals from 0 to 1, but value is an unbounded number, so probability: 42 validates. A conditional on ratingMeasure could enforce it:

"allOf": [{
  "if": { "properties": { "name": { "enum": ["probability", "percentile", "confidence"] } }, "required": ["name"] },
  "then": { "properties": { "value": { "minimum": 0, "maximum": 1 } } }
}]

[jkowalleck]

RFC notice sent on 18 September 2026.
RFC period ends on 16 October 2026.

[jkowalleck]

@stevespringett sometests are failing: https://github.com/CycloneDX/specification/actions/runs/36573034473/job/109421784604?pr=1117#step:5:25

 
> SchemaFile:  /home/runner/work/specification/specification/schema/2.0/cyclonedx-2.0.schema.json
> compile schema, log warnings ...
!!! SCHEMA ERROR: Error: strict mode: required property "score" is not defined at "https://cyclonedx.org/schema/2.0/model/cyclonedx-vulnerability-2.0.schema.json#/allOf/0/then/not" (strictRequired) 

[jkowalleck]

would love to see examples for the new "other" in the test suite