Re: [Uri-review] swid and swidpath URI scheme registration request

Ted,

These schemes will be used in the link structure of a coswid (see section 2.7). In a link the href is represented as text. The structure of the text would not need to be parsed, so a textual comparison I believe is appropriate.

The text string form would be percent encoded as you indicated. The UUID form would follow the "UUID" BNF defined in RFC4122 in section 3 and would also be represented as text.

If the text string contains Unicode characters, the codepoint would need to be converted to a byte sequence in UTF-8 and then each byte would be encoded per RFC3986 section 2.5.

Regards,
Dave

From: Ted Hardie <ted.ietf@gmail.com>
Sent: Friday, October 8, 2021 11:29 AM
To: Waltermire, David A. (Fed) <david.waltermire@nist.gov>
Cc: iana@iana.org; uri-review@ietf.org; sacm@ietf.org
Subject: Re: [Uri-review] swid and swidpath URI scheme registration request

Hi David,

My apologies, but I think I'm missing part of the scheme definition.  In Section 5.1, I see:

For URIs that use the "swid" scheme, the scheme specific part MUST

   consist of a referenced software tag's tag-id.  This tag-id MUST be

   URI encoded according to [RFC3986] Section 2.1.

   The following expression is a valid example:

   swid:2df9de35-0aff-4a86-ace6-f7dddd1ade4c

I would have typically expected an ABNF production for the tag-id.  Instead, I see the following:

tag-id (index 0): A 16 byte binary string or textual identifier

      uniquely referencing a software component.  The tag identifier

      MUST be globally unique.  If represented as a 16 byte binary

      string, the identifier MUST be a valid universally unique

      identifier as defined by [RFC4122].  There are no strict

      guidelines on how this identifier is structured, but examples

      include a 16 byte GUID (e.g. class 4 UUID) [RFC4122], or a text

      string appended to a DNS domain name to ensure uniqueness across

      organizations.
Given the free-form nature of the text alternative, do I understand correctly you intend to percent encode any reserved character?  Is this still the case if the DNS domain name is an IDN?

Since the text format subsumes the UUID format, is there a presumption that the equivalence rules for text are always preferred to the arithmetic equivalence rules that UUIDs may use?

regards,

Ted Hardie

On Fri, Oct 8, 2021 at 3:18 PM Waltermire, David A. (Fed) <david.waltermire=40nist.gov@dmarc.ietf.org<mailto:40nist.gov@dmarc.ietf.org>> wrote:
This request is for the registrations of the "swid" and "swidpath" schemes defined in sections 6.6.1 and 6.6.2 of https://datatracker.ietf.org/doc/draft-ietf-sacm-coswid/18/<https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-ietf-sacm-coswid%2F18%2F&data=04%7C01%7Cdavid.waltermire%40nist.gov%7C7c47eb061ac54402154108d98a706a24%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C637693037692730320%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=UYeM%2BXa%2BnhIiI%2FSAtmcmpAbA4hRPbPACzEdkNbh%2F8qY%3D&reserved=0>.

Please let us know if there are any questions or concerns.

Regards,
Dave Waltermire

_______________________________________________
Uri-review mailing list
Uri-review@ietf.org<mailto:Uri-review@ietf.org>
https://www.ietf.org/mailman/listinfo/uri-review<https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Furi-review&data=04%7C01%7Cdavid.waltermire%40nist.gov%7C7c47eb061ac54402154108d98a706a24%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C637693037692730320%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=AgSzdoVPSaUOj5EOpkc%2BrehZjTA9UlsfYXFgAUNd7gA%3D&reserved=0>