Re: [SCITT] Question regarding changes to the Vendor Response File format (now IETF property)

[Dick Brooks <[e-mail]>]

Thanks for clarifying, Jon.

 

I'll go forward and make this change given the VRF's "not official" status
within the IETF.

 

Thanks for the quick response. 

 

Thanks,

 

Dick Brooks

  

Active Member of the CISA Critical Manufacturing Sector, 

Sector Coordinating Council - A Public-Private Partnership

 

 <https://reliableenergyanalytics.com/products> Never trust software, always
verify and report! T

 <http://www.reliableenergyanalytics.com/>
http://www.reliableenergyanalytics.com

Email:  <mailto:[e-mail]>
[e-mail]

Tel: [phone]

 

 

From: Jon Geater <[e-mail]> 
Sent: Sunday, April 14, 2024 9:23 AM
To: [e-mail]; [e-mail]
Subject: Re: [SCITT] Question regarding changes to the Vendor Response File
format (now IETF property)

 

Hi Dick,

 

Thanks for your continued efforts in testing and promoting SCITT in these
very practical arenas. Good luck with your presentation. 

 

With respect the VRF, since it's not an officially adopted work item there's
no very formal change control in place or necessary. Much like the emulator
code that was developed at the same time it provides a good example artifact
and the demo we did was great proof of SCITT, but all of that is strictly in
service of getting the 3 official pieces of work right: the use cases; the
architecture; and SCRAPI.

 

All of which to say I think your suggestion sounds sensible and you should
make the change if you want to. If it materially affects the demo from 117
then it probably would be good to raise a PR against the emulator repo to
commit the new version. 

 

Jon

 

 

 

- 

Jon Geater

Chief Product & Technology Officer, DataTrails

  _____  

From: SCITT <[e-mail] <mailto:[e-mail]> > on
behalf of Dick Brooks <[e-mail]
<mailto:[e-mail]> >
Sent: Sunday, April 14, 2024 1:58:57 PM
To: [e-mail] <mailto:[e-mail]>  <[e-mail]
<mailto:[e-mail]> >
Subject: [SCITT] Question regarding changes to the Vendor Response File
format (now IETF property) 

 

Hello Everyone,

 

I will be presenting to a US Government Agency tomorrow showing how a
software supplier can satisfy the new US Government secure software
attestation requirements using CISA's RSAA repository and the "Secure
Software Attestation Form". The process I will demonstrate includes the
uploading of the attestation form along with other artifacts including
SBOM's VDR's and a Vendor Response File, like the one we demo'd in SF at
IETF 117.

I will share my slides after the presentation on 4/15, if anyone is
interested, please email me directly - I will not post the slides on the
IETF list.

 

One item that appears to be missing from the VRF, under the "Product"
section (see XML schema for VRF structure) is a "DescriptionURL", which
contains a link to  a product description.

 

Would there be any objection to adding a "DescriptionURL" to the VRF Schema
within the Product structure?

 

 

Thanks,

 

Dick Brooks

  

Active Member of the CISA Critical Manufacturing Sector, 

Sector Coordinating Council - A Public-Private Partnership

 

 <https://reliableenergyanalytics.com/products> Never trust software, always
verify and report! T

 <http://www.reliableenergyanalytics.com/>
http://www.reliableenergyanalytics.com

Email:  <mailto:[e-mail]>
[e-mail]

Tel: [phone]