Re: [Suit] SUIT rechartering: proposed text

[Michael Richardson <[e-mail]>]

Roman Danyliw <[e-mail]> wrote:
    >> -----Original Message-----
    >> From: Suit <[e-mail]> On Behalf Of Michael Richardson
    >> Sent: Sunday, October 31, 2021 7:03 PM
    >> To: suit <[e-mail]>
    >> Subject: Re: [Suit] SUIT rechartering: proposed text
    >>
    >>
    >> Dave Thaler <[e-mail]> wrote:
    >> > To respond to Michael: As for report on firmware update status,
    >> > we have https://datatracker.ietf.org/doc/draft-ietf-suit-report/
    >> > which is already a WG document.
    >>
    >> This is a data format, but lacks a transport, or a security model.
    >>
    >> I think that it should be interacting with (i.e. being embedded in) the RATS
    >> integration and/or the SBOM report in order for this to get signed.

    > Is that a charter or document feedback?

Good question.

We have two transport issues: getting images to devices, and getting status
back from the devices.

The architecture document speaks of status trackers as well as distribution
systems, and I understand that in some deployments this is already a
thing. In other places, there is nothing. (or nothing standard)

draft-ietf-suit-report provides a standard content for reporting.
It does not provide a transport to communicating that report to a status tracker.

The ICN work that I mentioned in the thread is a really good standards based
greenfield solution for distribution.   We should adopt that work and
standardize it as an option for those who have nothing else.
At the other end of the spectrum, we'll have devices that will do https:// to
the cloud to yank their image.

Many people would like some intermediate situations to save bandwidth and
speed up deployment:  it could be as simple as HTTP-authenticated https:
proxy to a port 3128 squid3 cache.

Even with all that work, we are lacking a standard status tracker and
transport for this suit-report.

So you are asking: is the problem that the charter isn't simple enough that
suit-report would satisfy it, or is suit-report not tall enough to satisfy
the charter.

My opinion is neither: there is a document missing, and perhaps the charter
needs to more explicitely say that.

--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide