Subject: Re: [sacm] AD Review of draft-ietf-sacm-coswid-15

From: Carsten Bormann <[email-masked]>
Date: Fri, 12 Feb 2021 16:20:25 +0100

On 2020-11-15, at 20:15, Roman Danyliw <[email-masked]> wrote:
> 
> 
> ** Section 2.9.4.  The date field here is a CDDL time type.  In SWID, the equivalent is a xs:date.  Wouldn't it be more appropriate to use a CDDL tstr here?
> [Update: I see you're tracking this and have a marker for it with [QUESTION: Is "time" a correct representation of XSD:date?]”

By now, we have RFC 8943, which defines two representations of calendar date:

   Tag:  1004
   Data Item:  UTF-8 text string
   Semantics:  [RFC3339] full-date string
   Reference:  RFC 8943

   Tag:  100 (ASCII 'd')
   Data Item:  Unsigned or negative integer
   Semantics:  Number of days since the epoch date 1970-01-01
   Reference:  RFC 8943

So tag 1004 is directly equivalent to xs:date’s XML text form, while tag 100 is a compact form of that that would be more appropriate for COSWID in my view.  
[Note that the conversion between the two is entirely based on the principles of the Gregorian calendar, it will not be messed with by politicians (and their desire to get a memorial monument by messing with time zones) or by the time-nuts and their leap seconds.]

               +==================+==============+=========+
               | Date             | Tag 1004     | Tag 100 |
               +==================+==============+=========+
               | October 9, 1940  | "1940-10-09" | -10676  |
               +------------------+--------------+---------+
               | December 8, 1980 | "1980-12-08" | 3994    |
               +------------------+--------------+---------+

                                  Table 1

As usual, we can import the definitions made in this RFC into other RFCs without necessarily using it *as a tag* (i.e., we can use a tag in unwrapped form, if desired).

Grüße, Carsten

---

From: David Kemp <[email-masked]>
Date: Wed, 17 Feb 2021 17:45:16 -0500

I believe CoSWID should use RFC 7049 Tag 1 (POSIX Time), with or without
the tag, defined as seconds since the epoch.  POSIX time is both more
compact and more computationally pure than strings and their myriad formats
and leap second hacks.

CoSWID is a newer document than SWID and should have the flexibility to
represent date-time, regardless of whether the current version of SWID is
restricted to date only.  Use cases should drive requirements, and it seems
plausible that software identifiers could be issued more than once per
day.  And if restriction to date resolution is desired by policy, it should
be expressed as policy rather than hard-coded into the underlying data
format.

Dave

On Fri, Feb 12, 2021 at 10:20 AM Carsten Bormann <[email-masked]> wrote:

> > ** Section 2.9.4.  The date field here is a CDDL time type.  In SWID,
> the equivalent is a xs:date.  Wouldn't it be more appropriate to use a CDDL
> tstr here?
> > [Update: I see you're tracking this and have a marker for it with
> [QUESTION: Is "time" a correct representation of XSD:date?]”
>
> So tag 1004 is directly equivalent to xs:date’s XML text form, while tag
> 100 is a compact form of that that would be more appropriate for COSWID in
> my view.
> [Note that the conversion between the two is entirely based on the
> principles of the Gregorian calendar, it will not be messed with by
> politicians (and their desire to get a memorial monument by messing with
> time zones) or by the time-nuts and their leap seconds.]
>
> As usual, we can import the definitions made in this RFC into other RFCs
> without necessarily using it *as a tag* (i.e., we can use a tag in
> unwrapped form, if desired).
>
> Grüße, Carsten
>
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm
>

---

From: Carsten Bormann <[email-masked]>
Date: Thu, 18 Feb 2021 00:21:59 +0100

On 17. Feb 2021, at 23:45, David Kemp <[email-masked]> wrote:
> 
> I believe CoSWID should use RFC 7049 Tag 1 (POSIX Time), with or without the tag, defined as seconds since the epoch.  POSIX time is both more compact and more computationally pure than strings and their myriad formats and leap second hacks.

I agree.  The only shortcoming of tag 1 is that it can’t express software release dates that fall on leap seconds.
Seriously, don’t do that then :-) [1]

> CoSWID is a newer document than SWID and should have the flexibility to represent date-time, regardless of whether the current version of SWID is restricted to date only.  Use cases should drive requirements, and it seems plausible that software identifiers could be issued more than once per day.  And if restriction to date resolution is desired by policy, it should be expressed as policy rather than hard-coded into the underlying data format.

Yes.  I was confused by the references to xs:date, which (according to the SWID schema) really should have been to xs:dateTime, which (with the above limitation) is an exact match.

Grüße, Carsten

[1]: http://www.catb.org/~esr/jargon/html/D/Don-t-do-that-then-.html