Subject: [OPSAWG] conclusion: how many SBOMs to retrieve

From: Eliot Lear <[email-masked]>
Date: Thu, 29 Apr 2021 14:42:52 +0200

Hi,

At least from the discussion thus far, with the discovery mechanism in draf-ietf-opsawg-sbom-access there is currently only a need to retrieve a single SBOM.  According to both SPDX and CycloneDx folk, they have sufficiently internalized any additional references.  CycloneDx can point directly to a URL, whereas with SPDX one further resolution before you get there.  I can’t say at this stage which is better, but from this draft’s perspective, its job is done either way, once the JSON extension is read and the initial SBOM is located.

Eliot

---

From: Michael Richardson <[email-masked]>
Date: Fri, 30 Apr 2021 07:11:36 -0400

Eliot Lear <lear=[email-masked]> wrote:
    > At least from the discussion thus far, with the discovery mechanism in
    > draf-ietf-opsawg-sbom-access there is currently only a need to retrieve
    > a single SBOM.
    
    > According to both SPDX and CycloneDx folk, they have
    > sufficiently internalized any additional references.

What about multi-function devices where more than one logical function
resides on the same physical platform?  AFAIK, Echo/HomeKit do not currently
provide any kind of isolation between skills, but I think, for instance, that
the mycroft.ai system is likely to use containers in the future.

I don't expect the internal containers to be visible from the outside.

    > CycloneDx can
    > point directly to a URL, whereas with SPDX one further resolution
    > before you get there.  I can’t say at this stage which is better, but
    > from this draft’s perspective, its job is done either way, once the
    > JSON extension is read and the initial SBOM is located.

    > Eliot _______________________________________________ OPSAWG mailing
    > list [email-masked] https://www.ietf.org/mailman/listinfo/opsawg

-- 
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide