[SCITT] My initial thoughts and comments on Use Case Document

[Yogesh Deshpande <[e-mail]>]

Hi All,
My initial comments looking at the overall state of the Use Case Document:
https://github.com/ietf-scitt/draft-birkholz-scitt-software-supply-chain-use-cases/blob/main/draft-birkholz-scitt-software-use-cases.md

(Please note that I will make these comments on github also).

General Comment:
We need to harmonize the format so that the shape and style of description of each use case looks similar.

Specific Comments:

Use Case 1: Trust Bond between Package Supplier and the Signing Authority


  1.  Missing bits: Needs to map the problem with real use case in hand? The use case starts more with a problem rather than describing a proper industry use case.
  2.  Remove the usage of word Trust and Trustworthiness but use lack of information on aspects that can be assertively verified by the end user, so that the trust factor is "implicitly"  established.

Use Case 2: Scalable Determination of Trustworthiness in Multi-Stakeholder Ecosystems
(a)   Title is very mis-leading: There is no scalability again in Trustworthiness. There is incremental mechanism of further deeper verification that grows the trust.
(b)   Need to re-write the title taking specific industry and its use case built into it.
(c)   Again need to highlight a real use case and then come to the problem what the use case exposes.

Use Case 3: I think UC #2 and UC #3 can be easily combined? There is a lot of duplication, the statements and "N" statements, Use Case 3 only adds a factor of time, into multiplicity.

Use Case 4:  This use case is not clear to me at all??  Specifically, the comment:
 Over time, there has been an increasing amount of providers of the same version of the software component source over the Internet ==> How can the same version of the software component source is produced by multiple vendors ?
Need to re-write the use case completely.
Use Case 5: Checking the History of Statements about Software by Auditors
Again, Better to demonstrate a real world example use case rather than jumping into the problem domain.

I propose, I will work with individual authors who originally proposed these sections to understand the real use case and the problem they see and tidy up the document.

Please let me know if anyone wants to provide help in this effort. I am more than happy to coordinate.

Regards,
Yogesh
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.