[Suit] Re: I-D Action: draft-ietf-suit-update-management-11.txt

[Deb Cooley <[e-mail]>]

Thanks for the quick response.

As long as the working group agrees with the updates, we are fine with
changes at this point.

Once you fix Section 3.2, the chairs can ask for a 2 week wglc - to ensure
that the working group is in agreement.  We could also ask Russ for a
re-review (both as a directorate reviewer, and as a past suit chair).

Deb

On Thu, May 28, 2026 at 3:32 AM Brendan Moran <[e-mail]> wrote:

> Hi Deb,
>
> Thank you. We will respond to the individual reviewers on the list before
> the telechat.
>
> On Section 3.2, agreed. The current text tried to address the review
> comment about optional extension metadata, but the ordering makes it harder
> to follow. We will reorganize the last two paragraphs along the structure
> you suggested:
>
> - state that support for suit-coswid is RECOMMENDED, with the rationale
> that durable software identity/SBOM metadata is useful for inventory,
> vulnerability management, compliance, and update-state reconciliation;
> - state that recipients that do not use suit-coswid are not required to
> process the CoSWID content;
> - state the acceptance/rejection behavior for recipients that do use or
> validate it: a recipient MUST NOT fail solely because a well-formed,
> policy-permitted suit-coswid field is present, but can still reject
> malformed metadata, failed digest/metadata validation, policy rejection,
> resource exhaustion, or unsupported critical behavior.
>
> On the larger additions: these were intended as consistency fixes rather
> than new protocol behavior.
>
> For Section 4.6.3, the old text used an `r/w/x` shorthand for component
> default permissions, while the CDDL used a larger permission bit set. We
> expanded the prose to match the CDDL so the document does not define one
> model in the body and another in Appendix A. The added names describe the
> permission bits already represented in the CDDL: read/list, write/create,
> traverse/execute, attribute, permission, owner, delete, and sync-related
> bits.
>
> For Section 6, the previous IANA text only listed a few bullet allocations
> and did not fully match the labels used by the draft and CDDL. The new
> tables make the IANA requests explicit for the SUIT Envelope, SUIT
> Manifest, SUIT Commands, SUIT Parameters, and SUIT Component Text
> registries. In particular, this accounts for suit-set-version, suit-coswid,
> suit-parameter-component-metadata, suit-text-version-required, and
> suit-text-current-version.
>
> For the CDDL, the changes reconcile stale standalone CDDL with the prose
> and embedded examples. The main fixes are:
> - `suit-current-version` was corrected to `suit-set-version`, matching
> Section 3.1 and the assigned label 6;
> - `suit-coswid` was typed as `bstr .cbor concise-swid-tag`, rather than an
> opaque `bstr` or command sequence;
> - the CDDL build now includes the CoSWID CDDL needed for that type;
> - extension parameters now use `$$SUIT_Parameters`, matching the extension
> point in the SUIT manifest CDDL;
> - component metadata now has explicit labels, file types, CBOR time tags,
> and `tstr` rather than the undefined `str`;
> - the body CDDL snippets for `override-multiple` and `copy-params` were
> aligned with the standalone CDDL;
> - the UTC wait-event entries in the prose table were added to the
> standalone CDDL.
>
> If you think any of these consistency fixes go beyond what should be done
> at this stage, we can reduce the diff and keep only the minimal
> review-comment fixes. Our intent was to avoid advancing -11 with known
> body/CDDL/IANA mismatches from the stale repository state.
>
> Best,
> Brendan
>
> *From: *Deb Cooley <[e-mail]>
> *Date: *Wednesday, 27 May 2026 at 20:23
> *To: *[e-mail] <[e-mail]>;
> [e-mail] <
> [e-mail]>
> *Cc: *[e-mail] <[e-mail]>
> *Subject: *[Suit] Re: I-D Action: draft-ietf-suit-update-management-11.txt
>
> I hope you are well.  This draft is better.  I have three
> requests/comments:
>
> 1.  Please respond to the reviewers on the list (ADs will look for this
> when the draft is on the telechat - which is the next step).
>
> 2.  Look at the last two paragraphs of Section 3.2.  We need to reorganize
> these so they make logical sense.
>
> Currently, I see Section 1 the extensions are Optional. Section 3.2 they
> can be ignored, if properly formatted not rejected, if improperly formatted
> rejected, and then the extension is RECOMMENDED.  My suggestion is to
> organize this as follows (I'll give you an outline):
>  - While this extension is Optional, it is RECOMMENDED (normally I'd tell
> you to outline what good can happen if it is done or what bad thing can
> happen if the guidance is ignored.  The whole 'optional' part makes this
> weird.  Consider dropping the 'Optional' part, since Recommended is in
> fact, optional anyway (not sure how that impacts other extensions).
>  - If the extension is not used - ignore it all
>  - If the extension is used - when can it be accepted, when can it be
> rejected.
>
> 3.  You added a lot, especially in Section 4.6.3, Section 6, and the CDDL
> .  Why?
>
> Deb
>
> On Tue, May 26, 2026 at 11:41 AM <[e-mail]> wrote:
>
> Internet-Draft draft-ietf-suit-update-management-11.txt is now available.
> It
> is a work item of the Software Updates for Internet of Things (SUIT) WG of
> the
> IETF.
>
>    Title:   Update Management Extensions for Software Updates for Internet
> of Things (SUIT) Manifests
>    Authors: Brendan Moran
>             Ken Takayama
>    Name:    draft-ietf-suit-update-management-11.txt
>    Pages:   27
>    Dates:   2026-05-26
>
> Abstract:
>
>    This specification describes extensions to the SUIT manifest format.
>    These extensions allow an update author, update distributor or device
>    operator to more precisely control the distribution and installation
>    of updates to devices.  These extensions also provide a mechanism to
>    inform a management system of Software Identifier and Software Bill
>    Of Materials information about an updated device.
>
> The IETF datatracker status page for this Internet-Draft is:
> https://datatracker.ietf.org/doc/draft-ietf-suit-update-management/
>
> There is also an HTMLized version available at:
> https://datatracker.ietf.org/doc/html/draft-ietf-suit-update-management-11
>
> A diff from the previous version is available at:
>
> https://author-tools.ietf.org/iddiff?url2=draft-ietf-suit-update-management-11
>
> Internet-Drafts are also available by rsync at:
> rsync.ietf.org::internet-drafts
>
>
> _______________________________________________
> Suit mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>
> IMPORTANT NOTICE: The contents of this email and any attachments are
> confidential and may also be privileged. If you are not the intended
> recipient, please notify the sender immediately and do not disclose the
> contents to any other person, use it for any purpose, or store or copy the
> information in any medium. Thank you.
>