Re: [Rats] Supply Chain Attestation (was Re: 3 Use cases)

[Michael Richardson <[e-mail]>]

Cleaning my inbox out, leads me to a thread I felt needed some love.

I think that Ned Smith wrote:
    > I think there are 3 classes of nesting logic:

    > 1 Subcomponent(s) that are Attested by a parent component (single layer
    > attestation of a multi-layered decomposition)
    > 2 Subcomponent(s) that are Attested by a parent component and Attesting
    > other subcomponents (layered attestations)
    > 3 Subcomponent(s) that are Attested by more than one parent component
    > (e.g. countersigned or co-signed)

Kathleen Moriarty <[e-mail]> wrote:
    > If you are just talking about the TEE case and not the manufacturer signing
    > use case, then the signatures do build from the base. But for what I would
    > call supply chain, the manufacturer or software developing organization is
    > the one to provide the signature and they know what software, modules. or
    > components they rely upon. Therefore, the 3 classes are not painting the
    > right picture for what I would call the supply chain use case. That's why
    > your nesting module looks different than what I stated, where I was talking
    > about what you are calling "endorsements'.

I am not sure if we have resolved this.
I think that we continue to have challenges with describing the component situation.
I suspect that what we need to do is to be somewhat prescriptive here, rather
than trying to make everyone happy with a single diagram.

--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-