Repository: oasis-open/cti-python-stix2

Issue:
Malware os_execution_envs changes
This property was renamed to operating_system_refs, is now list of Software SCO identifiers instead of strings, and no longer SHOULD be a CPE entry.

Discussion:
codecov-io: # [Codecov](https://codecov.io/gh/oasis-open/cti-python-stix2/pull/369?src=pr&el=h1) Report
> Merging [#369](https://codecov.io/gh/oasis-open/cti-python-stix2/pull/369?src=pr&el=desc) into [master](https://codecov.io/gh/oasis-open/cti-python-stix2/commit/3803e4bdd7877af8e11211f42261f324b2c92255?src=pr&el=desc) will **increase** coverage by `<.01%`.
> The diff coverage is `100%`.

[![Impacted file tree graph](https://codecov.io/gh/oasis-open/cti-python-stix2/pull/369/graphs/tree.svg?width=650&token=vzHZ2LBVZq&height=150&src=pr)](https://codecov.io/gh/oasis-open/cti-python-stix2/pull/369?src=pr&el=tree)

```diff
@@            Coverage Diff             @@
##           master     #369      +/-   ##
==========================================
+ Coverage   98.18%   98.18%   +<.01%     
==========================================
  Files         124      124              
  Lines       14230    14234       +4     
==========================================
+ Hits        13972    13976       +4     
  Misses        258      258
```


| [Impacted Files](https://codecov.io/gh/oasis-open/cti-python-stix2/pull/369?src=pr&el=tree) | Coverage Δ | |
|---|---|---|
| [stix2/v21/sdo.py](https://codecov.io/gh/oasis-open/cti-python-stix2/pull/369/diff?src=pr&el=tree#diff-c3RpeDIvdjIxL3Nkby5weQ==) | `94.53% <ø> (ø)` | :arrow_up: |
| [stix2/test/v21/test\_malware.py](https://codecov.io/gh/oasis-open/cti-python-stix2/pull/369/diff?src=pr&el=tree#diff-c3RpeDIvdGVzdC92MjEvdGVzdF9tYWx3YXJlLnB5) | `100% <100%> (ø)` | :arrow_up: |

------

[Continue to review full report at Codecov](https://codecov.io/gh/oasis-open/cti-python-stix2/pull/369?src=pr&el=continue).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/oasis-open/cti-python-stix2/pull/369?src=pr&el=footer). Last update [3803e4b...6494470](https://codecov.io/gh/oasis-open/cti-python-stix2/pull/369?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).


Patch:
diff --git a/stix2/v21/sdo.py b/stix2/v21/sdo.py
index 1d97261..5c87515 100644
--- a/stix2/v21/sdo.py
+++ b/stix2/v21/sdo.py
@@ -460,7 +460,7 @@ class Malware(STIXDomainObject):
         ('kill_chain_phases', ListProperty(KillChainPhase)),
         ('first_seen', TimestampProperty()),
         ('last_seen', TimestampProperty()),
-        ('os_execution_envs', ListProperty(StringProperty)),
+        ('operating_system_refs', ListProperty(ReferenceProperty(valid_types='software', spec_version='2.1'))),
         ('architecture_execution_envs', ListProperty(StringProperty)),
         ('implementation_languages', ListProperty(StringProperty)),
         ('capabilities', ListProperty(StringProperty)),


Test patch:
diff --git a/stix2/test/v21/test_malware.py b/stix2/test/v21/test_malware.py
index 53838c9..412d740 100644
--- a/stix2/test/v21/test_malware.py
+++ b/stix2/test/v21/test_malware.py
@@ -197,3 +197,22 @@ def test_malware_non_family_no_name():
         "is_family": False,
         "malware_types": ["something"],
     })
+
+
+def test_malware_with_os_refs():
+    software = stix2.parse({
+        "type": "software",
+        "name": "SuperOS",
+        "spec_version": "2.1",
+    })
+
+    malware = stix2.parse({
+        "type": "malware",
+        "id": MALWARE_ID,
+        "spec_version": "2.1",
+        "is_family": False,
+        "malware_types": ["something"],
+        "operating_system_refs": [software],
+    })
+
+    assert malware["operating_system_refs"][0] == software["id"]