[sacm] New version of SWIMA uploaded - resolves all open issues

["Schmidt, Charles M." <[e-mail]>]

Hi all,

Happy 2017. To celebrate the occasion, I have prepared a new draft of the SWIMA specification. The new draft closes out all the To-Do items in the previous draft (namely, the new IANA registry for Software Data Models, and providing instructions on using 2015 and 2009 SWID tags in XML) and also addresses all open issues. The new draft is named draft-ietf-sacm-nea-swid-patnc-00, reflecting that it is a WG draft. This draft has been uploaded both to the SACM portal and to GitHub.

With regard to said open issues:
Issue #1: Identification of data sources - There is a new section 3.1 that introduces Information Source, a new section 3.4.5 that describes how Information Sources are captured when reporting records, and then all attributes that deliver records have new fields that are used for indicating the data source of each record.
Issue #3: Include installation location - There is a new section 3.4.4 that describes how software location information is captured when reporting records, and all attributes that deliver records have new fields used to indicate the software location.
Issue #4: Support of user/vendor-defined data models - The data model is now indicated with a combination of PEN and data model type identifier. (Previously it was just a data model type identifier). Each vendor can use their PEN to define their own namespace of data model type identifier values. The spec also reserves all values greater than or equal to 192 in the IANA PEN (0) as definable by the local enterprise. There is a new section 3.2 that discusses data models in more detail, a new section 3.4.2 that describes how data model information is captured in records, and all attributes have been updated with new fields to capture this. In addition, section 9.4 has been filled in and describes the IANA registry for Software Data Models.
Issue #5: Clarify that SWIMA servers (specifically SW-PVs) MUST accept all data models - This is included in section 3.2
Issue #6: MTI Data Models - Also addressed in section 3.2. Requirement is to support (i.e., be able to generate Software Identifiers for) the formats specified in section 5 of the spec. Currently, those are SWID 2015 in XML and SWID 2009 in XML. We can add others for which there is interest. (COSWID anyone?)

Please check out these new sections and let me know what you think. I'm interested in whether people agree that these actually resolve the open issues adequately.

Thanks,
Charles