Re: [SCITT] Question regarding changes to the Vendor Response File format (now IETF property)

[Jon Geater <[e-mail]>]

Hi Dick,

Thanks for your continued efforts in testing and promoting SCITT in these very practical arenas. Good luck with your presentation.

With respect the VRF, since it’s not an officially adopted work item there’s no very formal change control in place or necessary. Much like the emulator code that was developed at the same time it provides a good example artifact and the demo we did was great proof of SCITT, but all of that is strictly in service of getting the 3 official pieces of work right: the use cases; the architecture; and SCRAPI.

All of which to say I think your suggestion sounds sensible and you should make the change if you want to. If it materially affects the demo from 117 then it probably would be good to raise a PR against the emulator repo to commit the new version.

Jon



—
Jon Geater
Chief Product & Technology Officer, DataTrails
________________________________
From: SCITT <[e-mail]> on behalf of Dick Brooks <[e-mail]>
Sent: Sunday, April 14, 2024 1:58:57 PM
To: [e-mail] <[e-mail]>
Subject: [SCITT] Question regarding changes to the Vendor Response File format (now IETF property)


Hello Everyone,



I will be presenting to a US Government Agency tomorrow showing how a software supplier can satisfy the new US Government secure software attestation requirements using CISA’s RSAA repository and the “Secure Software Attestation Form”. The process I will demonstrate includes the uploading of the attestation form along with other artifacts including SBOM’s VDR’s and a Vendor Response File, like the one we demo’d in SF at IETF 117.

I will share my slides after the presentation on 4/15, if anyone is interested, please email me directly – I will not post the slides on the IETF list.



One item that appears to be missing from the VRF, under the “Product” section (see XML schema for VRF structure) is a “DescriptionURL”, which contains a link to  a product description.



Would there be any objection to adding a “DescriptionURL” to the VRF Schema within the Product structure?





Thanks,



Dick Brooks

[cid:[e-mail]4639A0]  [cid:image004.png@01DA8E41.9A7CCEA0]

Active Member of the CISA Critical Manufacturing Sector,

Sector Coordinating Council – A Public-Private Partnership



Never trust software, always verify and report!<https://reliableenergyanalytics.com/products> ™

http://www.reliableenergyanalytics.com<http://www.reliableenergyanalytics.com/>

Email: [e-mail]<mailto:[e-mail]>

Tel: [phone]