[sacm] ROLIE Descriptor review

Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com> Wed, 20 November 2019 20:06 UTC

MIME-Version: 1.0
From: Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com>
Date: Wed, 20 Nov 2019 15:06:02 -0500
Message-ID: <CAHbuEH5qBdsYRoBDOSDGJeDdj2bNO7xFYp4pyzqfzdCH2B2xPg@mail.gmail.com>
To: "<sacm@ietf.org>" <sacm@ietf.org>
Content-Type: multipart/alternative; boundary="000000000000f39dac0597ccb75b"
Archived-At: <https://mailarchive.ietf.org/arch/msg/sacm/fOrvE8DyVOVJ12bMhfJ4FSKwIFI>
Subject: [sacm] ROLIE Descriptor review
Precedence: list

Hi Stephen, Dave, and SACM,

Thanks for all of your work on this draft.  It's well written and easy to
follow.  I just have a few clarifying comments (that could turn into some
more work - but I'm happy to help).

In the descriptor description, there's a nit:
s/defines an descendent/defines a descendent/

For the "patchedby", it seems confusing to allow this to represent patches
that have been applied and ones that can be applied.  Can that be separated
out into 2 link relationships or is there a reason they are combined?

Since the link descriptors are not in a registry, anyone could define
additional ones for their own use, is that correct?  If not, I want to
think about this list more and may have an addition or two (not many, but I
need to think a little).

In the registry, SWID and CoSWID are not specifically called out.  Wouldn't
it be helpful to set that as part of this spec to have it retrievable in a
consistent pattern? It seems like implementations can vary in lots of ways
from what is listed in section 8 to the properties about software in the
ATOM link descriptors in the earlier section.  I was expecting something
more prescriptive, but would be very interested to hear why it's not that
way in the document or if there are plans for that?

Here are some specific questions on the registry:

Is 8.1 supposed to contain a SWID or CoSWID?  If so, clarifying would be
helpful to avoid misinterpretation.  Is the signature included here or
not?  What is the representation?

For 8.2 - is the name supposed to follow a common format, perhaps the name
used in a SWID or CoSWID?

8.3 - Is there a preferred or required format to represent the version?  It
would make things easier if there were I would think

8.4 - Is there a format preference or requirement for the creator?

Are you defined objects here all in the SWID and CoSWID or might some be
properties carried as additional claims in a CWT if that were used with a
CoSWID?


Thank you!!

-- 

Best regards,
Kathleen

[sacm] ROLIE Descriptor review Kathleen Moriarty