Subject: [sacm] [sacmwg/draft-ietf-sacm-coswid] Addressed comments from WGLC reviewers. (#13)

From: David Waltermire <[email-masked]>
Date: Wed, 24 Jul 2019 14:48:47 -0700

Addressed comments from Alex, Ira and Carsten.

You can view, comment on, or merge this pull request online at:

  https://github.com/sacmwg/draft-ietf-sacm-coswid/pull/13

-- Commit Summary --

  * Addressed comments from WGLC reviewers.

-- File Changes --

    M concise-swid-tag.cddl (2)
    M draft-ietf-sacm-coswid.md (366)

-- Patch Links --

https://github.com/sacmwg/draft-ietf-sacm-coswid/pull/13.patch
https://github.com/sacmwg/draft-ietf-sacm-coswid/pull/13.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-coswid/pull/13

---

From: Alex Nelson <[email-masked]>
Date: Wed, 24 Jul 2019 17:42:37 -0700

ajnelson-nist commented on this pull request.

>  {: #model-extension}
 ## Concise SWID Extensions
 
 The CoSWID data definition contains two features that are not included in the SWID data definition on which it is based. These features are:
 
-- The explicit definition of types for attributes that are typically stored in
-  the "any attribute" of an ISO-19770-2:2015 in XML representation. These are
+- The explicit definition of types for attributes that are typically represented in

This sentence needs a light grammar adjustment.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-coswid/pull/13#pullrequestreview-266352362

---

From: Alex Nelson <[email-masked]>
Date: Wed, 24 Jul 2019 17:46:01 -0700

> @@ -701,9 +670,9 @@ The following describes each child item of this group.
 
 - colloquial-version (index 45): A textual value for the software component's informal or colloquial version. Examples may include a year value, a major version number, or similar value that are used to identify a group of specific software component releases that are part of the same release/support cycle. This version can be the same through multiple releases of a software component, while the software-version specified in the concise-swid-tag group is much more specific and will change for each software component release. This version is intended to be used for string comparison only and is not intended to be used to determine if a specific value is earlier or later in a sequence.
 
-- description (index 46): A textual value that provides a detailed description of the software component. This value MAY be multiple sentences.
+- description (index 46): A textual value that provides a detailed description of the software component. This value MAY be multiple paragraphs seperated by CR LF characters as described by {{RFC5198}}.

Typo: separated.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-coswid/pull/13#pullrequestreview-266353098

---

From: Alex Nelson <[email-masked]>
Date: Wed, 24 Jul 2019 17:48:26 -0700

>  {: #tbl-iana-link-rel-values title="CoSWID Link Relationship Inital Registrations"}
 
-Additional syntax requirements for registrations:
+Registrations MUST conform to the expert review guidlines defined in {{iana-review-guidelines}}.

Typo: guidelines.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-coswid/pull/13#pullrequestreview-266353586

---

From: Alex Nelson <[email-masked]>
Date: Wed, 24 Jul 2019 17:50:11 -0700

> +
+Pen: 0
+
+Integer: TBD2
+
+Name: Concise Software Identifier (CoSWID)
+
+Defining Specification: RFC-AAAA
+
+Deriving Software Identifiers:
+
+  A Software Identifier generated from a CoSWID tag is expressed as a concatenation of the form:
+
+    TAG_CREATOR_REGID "_" "_" UNIQUE_ID
+
+  Where TAG_CREATOR_REGID is the reg-id ietm value of the tag's entity item having the role value of 1 (corresponding to "tag creator"), and the UNIQUE_ID is the same tag's tag-id item. If the tag-id item's value is expressed as a 16 byte binary string, the the UNIQUE_ID MUST be represented using the UUID string representation defined in {{RFC4122}} including the "urn:uuid:" prefix.

Typo: "the the".

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-coswid/pull/13#pullrequestreview-266353933

---

From: Alex Nelson <[email-masked]>
Date: Wed, 24 Jul 2019 17:52:33 -0700

> @@ -1405,14 +1451,17 @@ security considerations regarding SWID/CoSWID tags focus on the application
 of SWID/CoSWID tags to address security challenges, and the possible
 disclosure of the results of those applications.
 
-A signed SWID/CoSWID tag whose signature has been validated can be relied upon to be
-unchanged since it was signed.  If the SWID/CoSWID tag was created by the
-software provider, is signed, and the software provider can be authenticated as the originator of the signature, then the tag can be considered authoritative.
-In this way, an authoritative SWID/CoSWID tag contains information about a software component provided by the maintainer of the software component, who is expected to be an expert in their own software. Thus, authoritative SWID/CoSWID tags can be trusted to represent authoritative information about the software component.  Having an authoritative SWID/CoSWID tag can be useful when the information in the
-tag needs to be trusted, such as when the tag is being used to convey
-reference integrity measurements for software components.  By contrast, the data contained in unsigned
+A tag is cnsidered "authoritative" if the SWID/CoSWID tag was created by the
+software provider. An authoritative SWID/CoSWID tag contains information about a software component provided by the maintainer of the software component, who is expected to be an expert in their own software. Thus, authoritative SWID/CoSWID tags can be trusted to represent authoritative information about the software component.  
+
+A signed SWID/CoSWID tag (see {{appendix-cose}}) whose signature has been validated can be relied upon to be
+unchanged since it was signed. By contrast, the data contained in unsigned o

Typo? Dangling `o`.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-coswid/pull/13#pullrequestreview-266354395

---

From: Alex Nelson <[email-masked]>
Date: Wed, 24 Jul 2019 17:52:41 -0700

Typo: "cnsidered".

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-coswid/pull/13#pullrequestreview-266354423

---

From: Alex Nelson <[email-masked]>
Date: Wed, 24 Jul 2019 17:53:15 -0700

> @@ -1461,10 +1510,14 @@ employ input sanitizing and loop detection on the tags they ingest.
 
 #  Acknowledgments
 
-TBD
+This document draws heavily on the concepts defined in the ISO/IEC 19770-2:2015 specification. The authors of this document are greatful for the prior work of the 19770-2 contributors.

Typo: "greatful".

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-coswid/pull/13#pullrequestreview-266354527

---

From: Henk Birkholz <[email-masked]>
Date: Wed, 24 Jul 2019 21:07:19 -0700

henkbirkholz commented on this pull request.

 

I think you are correct. Currently, I have a hard time parsing that myself. I'll merge this for now and keep this issue open.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-coswid/pull/13#discussion_r307107391

---

From: Henk Birkholz <[email-masked]>
Date: Wed, 24 Jul 2019 21:12:53 -0700

henkbirkholz approved this pull request.

I agree with all of Alex's comments, which are not addressed by this current merge and have to be addressed after merging. There are some new rage definitions for values, e.g. -256 - 65536 (if I remember correctly) these can be include in the CDDL specification with controls.

Text improvement is significant and strongly accepted.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-coswid/pull/13#pullrequestreview-266392386

---

From: Henk Birkholz <[email-masked]>
Date: Wed, 24 Jul 2019 21:13:52 -0700

Merged #13 into master.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-coswid/pull/13#event-2508256892