rfd: Introduce a Validation Library

[alilleybrinker]

This RFD describes the need to create a JavaScript library for validating CVE Records.

Rendered

[zmiele]

The versioning of this library would, for clarity and simplicity, be matched to the versioning of the CVE Record Format. Whenever new versions of the Record Format are published, a new release of the validation library with a matching version number would also be published.

One small concern that comes to mind here is that this will require the inverse to be true as well. If there is an issue with the library, we'll be required to bump the version of the schema in order to provide fixes in the validation library. Is that something we're comfortable with? If so, we'll need to keep that in mind when defining the versioning rules for the schema in #418.

[alilleybrinker]

@zmiele hm, that's a fair point. In general, I think that such a binding still makes sense. The schema and the validation library become, in effect, a single product with a single version. Fixes to address bugs would be a patch release for both, whether the error is in the schema or in the library.