STIXProject/python-stix — pull request #218 by bgro (2014-10-15 10:39:40+00:00)
Title: Fixing problem of randomly generated root observable id in indicators

Hi,

when an Indicator is created with several Observables in it, the Indicator-object randomly generates an identifier for the Observable required for wrapping a Observable Composition containing the user-specified observables. This identifier cannot be influenced via the API.

This is troublesome, because for certain use cases it is necessary that *all* identifiers of a STIX entity can be influenced by the user -- at least to the extent that two runs of the code yield exactly the same STIX entity with exactly the same identifiers. (The most obvious use-case is that more than one revisions of a STIX entity are to be generated -- obviously, the identifiers must stay the same.

The code in this pull request gives one possible solution to the problem: the identifier of the root observable is derived from the identifier of the indicator -- thus, several runs of XML-producing code with the same input will always generate the same XML output.

I realize the approach of this derivation is not ideal -- it would be better, if the user could freely specify the id of the root observable via the API, but that would require non-local changes.