Merge pull request #41 from rpiazza/main

revert cve workflow, correctly implement dictionaries in jsonschema

.github/workflows/cve-daily-update.yml

@@ -1,8 +1,6 @@
 name: cti-stix-commom-objects daily update
 on:
   schedule:
-    branches:
-      - main
     - cron: "0 0 * * *"
     # At the end of every day
 

extension-definition-specifications/malware-behavior/examples/behavior.json

@@ -18,7 +18,7 @@
             "attack-pattern--6ffad4be-bfe0-424f-abde-4d9a84a800ad",
             "attack-pattern--91541e7e-b969-40c6-bbd8-1b5352ec2938"
         ],
-        "tags": [{"Anti-Analysis-Type": "Detection"}],
+        "tags": {"Anti-Analysis-Type": "Detection"},
         "objective_refs": ["malware-objective--a6de0a96-50b6-441f-8e62-06eb6db84183"],
         "detection_rules": [
 	    {

extension-definition-specifications/malware-behavior/malware-behavior.json

@@ -42,13 +42,9 @@
                     "$comment": "not required, but if used, there must be 1 item"
 		},
 		"tags": {
-		    "type": "array",
-		    "items": {
-			"$ref": "http://raw.githubusercontent.com/oasis-open/cti-stix2-json-schemas/stix2.1/schemas/common/dictionary.json"
-		    },
+		    "$ref": "#/definitions/tags_dictionary",
 		    "description": "The dictionary keys MUST be the tag names where the values are the value of the tag.",
-		    "minItems": 1,
-                    "$comment": "not required, but if used, there must be 1 item"
+		    "$comment": "not required, but if used, there must be 1 item"
 		},
 		"objective_refs": {
 		    "description": "The malware-objective objects associated with the behavior.",
@@ -218,6 +214,11 @@
 		"rule_type"
 	    ]
 	},
+	"tags_dictionary": {
+	    "allOf": [{ "$ref": "http://raw.githubusercontent.com/oasis-open/cti-stix2-json-schemas/stix2.1/schemas/common/dictionary.json" }],
+	    "description": "Specifies tags and values.",
+            "additionalProperties": true
+	},
 	"implementation-language-ov": {
 	    "oneOf": [
 		{