Code review comment for ~alexmurray/ubuntu-cve-tracker:package-db-json-validation

I didn't see anything unexpected in these new changes. (That is to say, I'm not sure I love the end result, but I've also got nothing new to contribute there beyond hoping the datastructures can be simplified. These changes seemed fine in isolation anyway. :)

I figured that this datastructure was the result of a mechanical translation from the existing boilerplates; that also makes sense, but I was *really* hoping we'd wind up with a simpler model during this transition.

I think the "do away with separate title/description" option might be hard to work with: mariadb and mysql should be aliased in some way but definitely deserve their own descriptions. neovim and vim, mutt and neomutt, there's a lot of packages that are similar but different. Heck, a lot of what we need to track is like "gnulib is vendored into dozens of packages", and those things shouldn't share descriptions..

Thanks