Re: [sacm] WGLC for draft-ietf-sacm-coswid

[Carsten Bormann <[e-mail]>]

Nice piece of work.
While I didn’t have time to fully check the whole I-D, I skimmed it, and came up with the following.  I’ll also send a few editorial comments to the authors.

Grüße, Carsten

# Major

The term "private use" is used repeatedly but not explained.
Is this meant for random software authors to dump random information
into their coswid tags?  Are there any usage guidelines?  This sounds
like an X-Dash problem waiting to happen (please see RFC 6648).

The document qualifies some values as 8-bit, 16-bit etc.  That is
unnecessary.  Any value ranges that are important should be given, and
they need to be consistent (version-scheme cannot be both 8-bit and
have a private use range of 32768-65535).  If a value range is
important, it should also be visible in the CDDL.

The way URIs are used is trampling on the URI scheme space (coswid:,
swidpath:).  Maybe not much can be salvaged there, but shouldn't these
be registered?

# Minor

[SEMVER] -- is this really needed as a normative reference?
Please also compare draft-verdt-netmod-yang-semver

Similarly, [SWID-GUIDANCE] is not a great source for a normative
reference.  AFAICS, this is used to define
"primary/patch/corpus/supplemental".  Can this be drawn out of the
original [SWID]?

I don't think you have a fragment identifier scheme, even though the
media type registration is written for one (with a dangling internal
reference).  Since this is a +cbor media type, any fragment identifier
scheme would also have to include any defined for CBOR itself (none so
far), but beyond that RFC 7049 gives you freedom.  Do you want to use
those fragment identifiers?  If no, please update the fragment
identifier scheme text in the media type registration to no longer
point to it.

Is there a point in carrying around GUIDs in text form?  Text (in RFC
4122 form) is 36 bytes, binary is 16.



> On Jun 27, 2019, at 22:36, Karen O'Donoghue <[e-mail]> wrote:
> 
> Folks,
> 
> As discussed at our virtual interim on Tuesday, this begins a three week working group last call for: 
> 
> Concise Software Identification Tags
> https://datatracker.ietf.org/doc/draft-ietf-sacm-coswid/
> 
> Please reply to this email thread with an indication that you have read the document, any comments you may have, and your assessment of whether or not it is ready to proceed to publication. 
> 
> DEADLINE: Please reply by Friday 19 July 2019. 
> 
> Thanks!
> Karen and Chris