[sacm] Resolving DISCUSSes on draft-ietf-sacm-coswid-21

[Roman Danyliw <[e-mail]>]

Hi!

draft-ietf-sacm-coswid-21 now has enough IESG ballots to clear if the DISCUSS positions are cleared.  I haven't seen discussion of these issues since Feb 17, 2022 (https://mailarchive.ietf.org/arch/msg/sacm/4loVm_L97V2-4wPrJ5-GD6vp7w4/) unless they are buried in a github issue.

Per Rob Wilton's DISCUSS:

> 1.  While an attempt to align
>   SWID and CoSWID tags has been made here, future revisions of ISO/IEC
>   19770-2:2015 or this specification might cause this implicit
>   information model to diverge, since these specifications are
>   maintained by different standards groups.
>
> This text concerns me, in that it seems that the IETF is expecting or allowing the SWID and CoSWID 
> specification to diverge.
>
> Would it be possible to have stronger text here? E.g., to indicate:
> - the intent is to keep the two spec's consistent.
> - nothing should be added to CoSWID without working with ISO/IEC to update CoSWID
> - if SWID evolves then CoSWID should be similarly updated.
>
> Or, otherwise, are ISO/IEC okay with the IETF effectively forking their specification in future?

What is the desired approach to document this issue?  Is there any ISO/IEC artifact we can use?  Is there a summarized version from the IETF-side?  This link to ISO/IEC SWID has been brought up before and the relationship answer has changed.  I last noted that on January 2022 (https://mailarchive.ietf.org/arch/msg/sacm/VYFMLttkbe2u4KfK3v-JgrxLfjU/) during IETF LC feedback processes.

> 2.
>   [SEMVER]   Preston-Werner, T., "Semantic Versioning 2.0.0",
>              <https://semver.org/spec/v2.0.0.html>.
>
> I want to check whether this URL is stable enough for a normative reference.  
> During the YANG Semver work we discovered, that despite the Semver 
> specification stating that is follows the Semver rules, in fact it doesn't! 
> Specifically, the specification has been updated without changing the version number.  
> The proposed solution for the YANG semver draft was to reference a specific data 
> and revision of the "YANG Semver 2.0.0" specification in github.
> the YANG Semver 2.0.0 specification on a given data.
>
>   [semver]   "Semantic Versioning 2.0.0 (text from June 19, 2020)",
>              <https://github.com/semver/semver/
>              blob/8b2e8eec394948632957639dfa99fc7ec6286911/semver.md>.
>
> Would doing something similar be wise here?

I already proposed the solution for this in my AD review on March 6, 2021:

https://mailarchive.ietf.org/arch/msg/sacm/IDi8scO7T4PhTXLA-Wzvl-XnbiQ/

==[ snip ]==
** [-15] Section 4.1 and 5.2.4.  [SEMVER] doesn't meet the threshold for a normative requirement and a "specification required" - it's just a website.  If this is used in SWID then that would be compelling argument to waiver it.  However, that should be explicitly stated here.  If it isn't, we should discuss it a bit more.

[-16: Can the ISO spec please be used as the basis for this reference (even it just points to the same website?)]
==[ snip ]==

I have spoke with Rob and this change will address his concern.  Specifically, move the current [SEMVER] to being an informational reference.  Make [SWID] the normative reference for semantic versioning.

Regards,
Roman