Subject: Re: [art] [Last-Call] Artart last call review of draft-ietf-sacm-coswid-18

From: Francesca Palombini <[email-masked]>
Date: Tue, 15 Feb 2022 22:04:58 +0000

Rich: thank you very much for this review! Following the author’s response (on a different thread: https://mailarchive.ietf.org/arch/msg/sacm/aoMc3Y5ZaY5HiMcnQkxORfoNBgU/ ), I have balloted No Objection.

Francesca

From: last-call <[email-masked]> on behalf of Rich Salz via Datatracker <[email-masked]>
Date: Monday, 2 August 2021 at 21:56
To: [email-masked] <[email-masked]>
Cc: [email-masked] <[email-masked]>, [email-masked] <[email-masked]>, [email-masked] <[email-masked]>
Subject: [Last-Call] Artart last call review of draft-ietf-sacm-coswid-18
Reviewer: Rich Salz
Review result: Ready with Nits

I am the ART directorate reviewer for this document. The comments are mainly
for the ADs, but others should treat them like any other last-call comments.

I did not shell at the 187 CHF for the SWID specification.  Kudo's to the
authors for doing something that seems (claims?) to be compatible, in an
infoset way, and is also much more compact.  A couple of minor things.

In 2.3, why are there three separate bools for corpus/patch/supplemental as
opposed to a single enumeration? Can the tag-id be a digest of the source file?
What are the implications of it not being unique? That should be listed in the
security considerations.

The expert review guidelines seem like "specification required" with some
additional requirements on things like what the specification must say.

I was surprised to see Carsten's full contact information given, as if he were
a co-author.

--
last-call mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/last-call

---

From: Rob Sayre <[email-masked]>
Date: Tue, 15 Feb 2022 14:17:29 -0800

How does the document treat the resource costs of binding of prefixes to
XML Namespaces? Can't they go on forever if left unchecked?

Is this issue handled in a reference? If so, perhaps a pointer would be
helpful.

thanks,
Rob

On Tue, Feb 15, 2022 at 2:05 PM Francesca Palombini <francesca.palombini=
[email-masked]> wrote:

> Rich: thank you very much for this review! Following the author’s response
> (on a different thread:
> https://mailarchive.ietf.org/arch/msg/sacm/aoMc3Y5ZaY5HiMcnQkxORfoNBgU/
> ), I have balloted No Objection.
>
>
>
> Francesca
>
>
>
> *From: *last-call <[email-masked]> on behalf of Rich Salz via
> Datatracker <[email-masked]>
> *Date: *Monday, 2 August 2021 at 21:56
> *To: [email-masked] <[email-masked]>
> *Cc: [email-masked] <[email-masked]>, [email-masked] <
> [email-masked]>, [email-masked] <
> [email-masked]>
> *Subject: *[Last-Call] Artart last call review of
> draft-ietf-sacm-coswid-18
>
> Reviewer: Rich Salz
> _______________________________________________
> art mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/art
>