Re: [urn] Namespace Identifier: Requested of IANA - cdx

[Peter Saint-Andre <[e-mail]>]

Hi everyone,

This namespace has now been registered:

https://www.iana.org/assignments/urn-formal/cdx

Peter

On 3/19/22 3:36 PM, Peter Saint-Andre wrote:
> Hi Pat,
> 
> Your latest iteration looks good to me (and Dale and Juha), so I think 
> we're ready to proceed. I will follow up with IANA and report back.
> 
> Peter
> 
> On 3/19/22 7:26 AM, Patrick Dwyer wrote:
>> Hi all,
>>
>> Is there anything else I need to do to register this URN namespace?
>>
>> Regards,
>> Pat
>>
>> On Tue, Feb 1, 2022 at 9:29 PM Hakala, Juha E 
>> <[e-mail]> wrote:
>>>
>>> Hello Patrick,
>>>
>>> this looks fine; I approve the request.
>>>
>>> All the best,
>>>
>>> Juha
>>>
>>> -----Alkuperäinen viesti-----
>>> Lähettäjä: urn <[e-mail]> Puolesta Patrick Dwyer
>>> Lähetetty: tiistai 1. helmikuuta 2022 4.28
>>> Vastaanottaja: [e-mail]
>>> Aihe: Re: [urn] Namespace Identifier: Requested of IANA - cdx
>>>
>>> Juha, thanks for more great feedback.
>>>
>>> Apologies for taking so long to get this revision back to the group.
>>>
>>> New version:
>>>
>>> Namespace Identifier:  Requested of IANA - cdx
>>>
>>> Version: 1
>>>
>>> Date: 2022-01-01
>>>
>>> Registrant: Patrick Dwyer, on behalf of the OWASP CycloneDX project.
>>> Email: [e-mail]
>>> Address:
>>> The OWASP Foundation Inc.
>>> 401 Edgewater Place, Suite 600
>>> Wakefield, MA 01880
>>>
>>> Purpose:
>>>
>>> CycloneDX is a software bill of materials OWASP standard. CycloneDX 
>>> bill of materials documents (BOMs) are intended to be exchanged 
>>> between different parties of the software supply chain.
>>>
>>> URNs in the "cdx" namespace are used as a means of persistently 
>>> identifying CycloneDX BOMs.
>>>
>>> When creating a BOM, a CycloneDX URN can be used to reference an 
>>> upstream BOM for a component rather than embedding it inline. This 
>>> may be a consideration for performance reasons. Especially in 
>>> resource constrained environments such as embedded devices. It can 
>>> also be used when a software supplier does not have authority to 
>>> share upstream BOM content directly.
>>>
>>> CycloneDX also supports "BOM refs". A BOM ref is a reference to a 
>>> particular element within a BOM. A "cdx" URN with an f-component is a 
>>> BOM ref, with the f-component specifying the location of the element 
>>> within the BOM identified by the URN.
>>>
>>> Syntax:
>>>
>>> The syntax for a CycloneDX URN namestring is defined using the 
>>> Augmented Backus-Naur Form (ABNF) below. It uses "UUID" as defined in 
>>> [RFC4122] and "f-component" as defined in [RFC3986].
>>>
>>>    namestring             = assigned-name [ "#" f-component ]
>>>    assigned-name          = "urn:cdx:" NSS
>>>    NSS                    = bom-serial-number "/" bom-version
>>>    bom-serial-number-uuid = UUID
>>>    bom-version            = nonzero-digit *digit ; an integer >= 1
>>>    nonzero-digit          = %x31-39 ; 1-9
>>>
>>> Assignment:
>>>
>>> CycloneDX URNs are assigned in a decentralised way, using the BOM 
>>> serial number. BOM serial numbers are version 4 UUIDs as defined in 
>>> [RFC4122]. Once assigned, BOM serial numbers are unique and persistent.
>>>
>>> Security and Privacy:
>>>
>>> As CycloneDX URNs are based on UUIDs they have the same security 
>>> considerations as UUID URNs as per [RFC4122].
>>>
>>> Additionally, there are no specification limitations beyond [RFC3986] 
>>> on what can be included in an f-component. Given that f-components 
>>> may be published in CyclineDX URNs, producers of BOMs should avoid 
>>> using any value on which there are sharing restrictions. For 
>>> producers of BOMs who have high confidentiality requirements, it is 
>>> recommended to use UUIDs for f-components.
>>>
>>> Interoperability:
>>>
>>> Although CycloneDX BOMs may use a UUID URN to identify a BOM via its 
>>> BOM serial number, the serial number isn’t sufficient when 
>>> referencing a BOM because a particular BOM may be revised over time. 
>>> Even in the case of legacy software that is not conceptualized as 
>>> changing, mistakes and omissions can be corrected over time causing 
>>> changes in the BOM. This is allowed for by successive "cdx" URNs in 
>>> which the BOM serial number is static and the version is incremented.
>>>
>>>
>>> On Fri, Jan 21, 2022 at 12:35 PM Dale R. Worley <[e-mail]> 
>>> wrote:
>>>>
>>>> Patrick Dwyer <[e-mail]> writes:
>>>>> Thanks for the great feedback Dale.
>>>>>
>>>>> Revised below:
>>>>>
>>>>> Namespace Identifier:  Requested of IANA - cdx
>>>>>
>>>>> Version:  1
>>>>>
>>>>> Date:  2022-01-01
>>>> [...]
>>>>
>>>> That covers everything I thought was an issue.  It looks good to me.
>>>>
>>>> Dale
>>>
>>> _______________________________________________
>>> urn mailing list
>>> [e-mail]
>>> https://www.ietf.org/mailman/listinfo/urn
>>
>> _______________________________________________
>> urn mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/urn
>