Re: [OPSAWG] 🔔 WG Adoption Call on draft-lear-opsawg-sbom-access-00

Hi, authors of draft-lear-opsawg-sbom-access-00:
What is key difference between sbom-url and local-uri? I feel a little bit confused when reading the definition of sbom-url and local-uri
Based on the definition of local-url,
"
case local-uri {
            description
              "The choice of sbom-local means that the SBOM resides at
              a location indicated by an indicted scheme for the
              device in question, at well known location
              '/.well-known/sbom'.  For example, if the MUD file
              indicates that coaps is to be used and the host is
              located at address 10.1.2.3, the SBOM could be retrieved
              at 'coaps://10.1.2.3/.well-known/sbom'.  N.B., coap and
              http schemes are NOT RECOMMENDED.";
          }
"
I think local-url is more related to well know url while sbom url is more related to local domain URL, what am I missing?
The question is Should SBOM server be discovered in the Cloud or in the local domain?

-Qin
-----邮件原件-----
发件人: OPSAWG [mailto:opsawg-bounces@ietf.org] 代表 Henk Birkholz
发送时间: 2021年1月5日 0:10
收件人: opsawg <opsawg@ietf.org>
主题: [OPSAWG] 🔔 WG Adoption Call on draft-lear-opsawg-sbom-access-00

Dear OPSAWG members,

this starts a call for Working Group Adoption on
https://tools.ietf.org/html/draft-lear-opsawg-sbom-access-00 ending on Monday, January 25.

As a reminder, this I-D describes different ways to acquire Software Bills of Material (SBOM) about distinguishable managed entities. The work was updated by the authors on October 13th and now elaborates on three ways SBOM can be found, including a MUD URI as one of the options.

Please reply with your support and especially any substantive comments you may have.

For the OPSAWG co-chairs,

Henk

_______________________________________________
OPSAWG mailing list
OPSAWG@ietf.org
https://www.ietf.org/mailman/listinfo/opsawg