Re: [urn] Namespace Identifier: Requested of IANA - cdx
Patrick Dwyer <patrick.dwyer@owasp.org> Mon, 28 March 2022 22:42 UTC
Return-Path: <patrick.dwyer@owasp.org>
X-Original-To: urn@ietfa.amsl.com
Delivered-To: urn@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 79FBD3A0451 for <urn@ietfa.amsl.com>; Mon, 28 Mar 2022 15:42:05 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.109
X-Spam-Level:
X-Spam-Status: No, score=-2.109 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=owasp.org
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pEl4NkEfojVS for <urn@ietfa.amsl.com>; Mon, 28 Mar 2022 15:42:00 -0700 (PDT)
Received: from mail-yb1-xb2b.google.com (mail-yb1-xb2b.google.com [IPv6:2607:f8b0:4864:20::b2b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 556903A078A for <urn@ietf.org>; Mon, 28 Mar 2022 15:42:00 -0700 (PDT)
Received: by mail-yb1-xb2b.google.com with SMTP id g9so26160153ybf.1 for <urn@ietf.org>; Mon, 28 Mar 2022 15:42:00 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=owasp.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=6Gf2/YmNI3zjs7nWb+1+0qpxvF0SdxW6WbFjWSP0Jp4=; b=Mfi++DF3ruO/NUjX9baUvcAPPZY+cW0JWmRjk1ayzoAgDQwFOhzDcWWSjyiGfI32XF xbRG44VNEWFzin/c5BiFqbgqN9cE2clyj05JriSASQxgNsyMKCzVI4J4D6v0XFbf6jCs 2a5OqrvqBNGdEnk/pQG2ZyV252wMuzZi0e42o7hPWn4b4GMTKDlhOatBlkShdgbwNOs7 KX7DlzWtNdlvirWDlUXNOkso9wNDTe6adzdxFZmODOjcsITq8nv86mfWgGVNtQAKa0rg fr4ouCwhCXtqn0QPgHo0PI8c+i5BWAwTDqKYwTQ7S5l8r5gqsa9B0BpKKm0nY9r695xX wVeQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=6Gf2/YmNI3zjs7nWb+1+0qpxvF0SdxW6WbFjWSP0Jp4=; b=29k43QbD7VX8oRmGjsuBrEuBX5Qtjz1ctLV81BSJHJyq20q++KzbQywOnEwDJW1YDQ cFLEnxvGlDmU5Umiz3sup9XKScQvtAMZ1pwv7BYraawa3PiIRzqvQBZJK4olNnkRyW82 mPbz6ITcD4kzd0FTR3VPytZjr2L3XU9pLB/Cgls3pP9lCuvLMDccGxekUVG48XWXFJcd zZhjIR2+8t4T2bjAfvYOS79y+rElFvGMheIwv8ubisthH0s+2qda0gt4I6hVx6TKD2VH CBycPSRz12TvUXboiH3/WPQtR8Qvzvvl0+DMqAaGAksi8nnuv7+SE2dQg+hwo0Ks9ltG Vwfw==
X-Gm-Message-State: AOAM533ZlejY793vOVwP55cKfoSFApVdIxSL44dMmOf/E3hfy+aoMaxS gTpmkuYcc7M3KHXpTwzvbbU+SWibrfo2PF9EpsMLLsKt2+GKG7W4
X-Google-Smtp-Source: ABdhPJyIJulwg4Sm683CBYk++QiwD8x959sJZTuQv6mgIddWjZjrJDuMdRuM3L07VryYT3/eyeUU/JAPTH+hMNyqQUc=
X-Received: by 2002:a05:6902:108:b0:621:165e:5c1e with SMTP id o8-20020a056902010800b00621165e5c1emr24145782ybh.204.1648507318650; Mon, 28 Mar 2022 15:41:58 -0700 (PDT)
MIME-Version: 1.0
References: <CACjy5ZfuG8yARFdboBOq0QrVhEWtGL+2UAuypjeP9xhUjXNEyA@mail.gmail.com> <87tudxg6ju.fsf@hobgoblin.ariadne.com> <CACjy5ZdU=OpwNoLDmNh5jtZi2zJJHPHNHCBmEFStouRKpM8t0Q@mail.gmail.com> <HE1PR07MB31961709C292E18F3D3D703FFA269@HE1PR07MB3196.eurprd07.prod.outlook.com> <CACjy5ZfN2cSHwtDT_E8DLhPSbrycGKEHK_L2GpXJ6=5eHn9apg@mail.gmail.com> <ebd5107b-d2bd-e5b0-6452-5e0f8a2e258d@stpeter.im> <b07c9130-a489-68d6-c64d-fd124cdf6cdf@stpeter.im>
In-Reply-To: <b07c9130-a489-68d6-c64d-fd124cdf6cdf@stpeter.im>
From: Patrick Dwyer <patrick.dwyer@owasp.org>
Date: Tue, 29 Mar 2022 08:41:47 +1000
Message-ID: <CACjy5ZdU+W+=x9Y-i_CTZQvdb0V2dfDGHaftOBphmpseXgD-Xw@mail.gmail.com>
To: Peter Saint-Andre <stpeter@stpeter.im>
Cc: urn@ietf.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://mailarchive.ietf.org/arch/msg/urn/nRsORIr9h6yb6hN6264DdHEBXo8>
Subject: Re: [urn] Namespace Identifier: Requested of IANA - cdx
X-BeenThere: urn@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Revisions to URN RFCs <urn.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/urn>, <mailto:urn-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/urn/>
List-Post: <mailto:urn@ietf.org>
List-Help: <mailto:urn-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/urn>, <mailto:urn-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 28 Mar 2022 22:42:06 -0000
Thank you everyone for your time and feedback. On Tue, Mar 29, 2022 at 7:30 AM Peter Saint-Andre <stpeter@stpeter.im> wrote: > > Hi everyone, > > This namespace has now been registered: > > https://www.iana.org/assignments/urn-formal/cdx > > Peter > > On 3/19/22 3:36 PM, Peter Saint-Andre wrote: > > Hi Pat, > > > > Your latest iteration looks good to me (and Dale and Juha), so I think > > we're ready to proceed. I will follow up with IANA and report back. > > > > Peter > > > > On 3/19/22 7:26 AM, Patrick Dwyer wrote: > >> Hi all, > >> > >> Is there anything else I need to do to register this URN namespace? > >> > >> Regards, > >> Pat > >> > >> On Tue, Feb 1, 2022 at 9:29 PM Hakala, Juha E > >> <juha.hakala@helsinki.fi> wrote: > >>> > >>> Hello Patrick, > >>> > >>> this looks fine; I approve the request. > >>> > >>> All the best, > >>> > >>> Juha > >>> > >>> -----Alkuperäinen viesti----- > >>> Lähettäjä: urn <urn-bounces@ietf.org> Puolesta Patrick Dwyer > >>> Lähetetty: tiistai 1. helmikuuta 2022 4.28 > >>> Vastaanottaja: urn@ietf.org > >>> Aihe: Re: [urn] Namespace Identifier: Requested of IANA - cdx > >>> > >>> Juha, thanks for more great feedback. > >>> > >>> Apologies for taking so long to get this revision back to the group. > >>> > >>> New version: > >>> > >>> Namespace Identifier: Requested of IANA - cdx > >>> > >>> Version: 1 > >>> > >>> Date: 2022-01-01 > >>> > >>> Registrant: Patrick Dwyer, on behalf of the OWASP CycloneDX project. > >>> Email: patrick.dwyer@owasp.org > >>> Address: > >>> The OWASP Foundation Inc. > >>> 401 Edgewater Place, Suite 600 > >>> Wakefield, MA 01880 > >>> > >>> Purpose: > >>> > >>> CycloneDX is a software bill of materials OWASP standard. CycloneDX > >>> bill of materials documents (BOMs) are intended to be exchanged > >>> between different parties of the software supply chain. > >>> > >>> URNs in the "cdx" namespace are used as a means of persistently > >>> identifying CycloneDX BOMs. > >>> > >>> When creating a BOM, a CycloneDX URN can be used to reference an > >>> upstream BOM for a component rather than embedding it inline. This > >>> may be a consideration for performance reasons. Especially in > >>> resource constrained environments such as embedded devices. It can > >>> also be used when a software supplier does not have authority to > >>> share upstream BOM content directly. > >>> > >>> CycloneDX also supports "BOM refs". A BOM ref is a reference to a > >>> particular element within a BOM. A "cdx" URN with an f-component is a > >>> BOM ref, with the f-component specifying the location of the element > >>> within the BOM identified by the URN. > >>> > >>> Syntax: > >>> > >>> The syntax for a CycloneDX URN namestring is defined using the > >>> Augmented Backus-Naur Form (ABNF) below. It uses "UUID" as defined in > >>> [RFC4122] and "f-component" as defined in [RFC3986]. > >>> > >>> namestring = assigned-name [ "#" f-component ] > >>> assigned-name = "urn:cdx:" NSS > >>> NSS = bom-serial-number "/" bom-version > >>> bom-serial-number-uuid = UUID > >>> bom-version = nonzero-digit *digit ; an integer >= 1 > >>> nonzero-digit = %x31-39 ; 1-9 > >>> > >>> Assignment: > >>> > >>> CycloneDX URNs are assigned in a decentralised way, using the BOM > >>> serial number. BOM serial numbers are version 4 UUIDs as defined in > >>> [RFC4122]. Once assigned, BOM serial numbers are unique and persistent. > >>> > >>> Security and Privacy: > >>> > >>> As CycloneDX URNs are based on UUIDs they have the same security > >>> considerations as UUID URNs as per [RFC4122]. > >>> > >>> Additionally, there are no specification limitations beyond [RFC3986] > >>> on what can be included in an f-component. Given that f-components > >>> may be published in CyclineDX URNs, producers of BOMs should avoid > >>> using any value on which there are sharing restrictions. For > >>> producers of BOMs who have high confidentiality requirements, it is > >>> recommended to use UUIDs for f-components. > >>> > >>> Interoperability: > >>> > >>> Although CycloneDX BOMs may use a UUID URN to identify a BOM via its > >>> BOM serial number, the serial number isn’t sufficient when > >>> referencing a BOM because a particular BOM may be revised over time. > >>> Even in the case of legacy software that is not conceptualized as > >>> changing, mistakes and omissions can be corrected over time causing > >>> changes in the BOM. This is allowed for by successive "cdx" URNs in > >>> which the BOM serial number is static and the version is incremented. > >>> > >>> > >>> On Fri, Jan 21, 2022 at 12:35 PM Dale R. Worley <worley@ariadne.com> > >>> wrote: > >>>> > >>>> Patrick Dwyer <patrick.dwyer@owasp.org> writes: > >>>>> Thanks for the great feedback Dale. > >>>>> > >>>>> Revised below: > >>>>> > >>>>> Namespace Identifier: Requested of IANA - cdx > >>>>> > >>>>> Version: 1 > >>>>> > >>>>> Date: 2022-01-01 > >>>> [...] > >>>> > >>>> That covers everything I thought was an issue. It looks good to me. > >>>> > >>>> Dale > >>> > >>> _______________________________________________ > >>> urn mailing list > >>> urn@ietf.org > >>> https://www.ietf.org/mailman/listinfo/urn > >> > >> _______________________________________________ > >> urn mailing list > >> urn@ietf.org > >> https://www.ietf.org/mailman/listinfo/urn > > >
- [urn] Namespace Identifier: Requested of IANA - c… Patrick Dwyer
- Re: [urn] Namespace Identifier: Requested of IANA… Peter Saint-Andre
- Re: [urn] Namespace Identifier: Requested of IANA… Patrick Dwyer
- Re: [urn] Namespace Identifier: Requested of IANA… Peter Saint-Andre
- Re: [urn] Namespace Identifier: Requested of IANA… worley
- Re: [urn] Namespace Identifier: Requested of IANA… Patrick Dwyer
- Re: [urn] Namespace Identifier: Requested of IANA… Hakala, Juha E
- Re: [urn] Namespace Identifier: Requested of IANA… worley
- Re: [urn] Namespace Identifier: Requested of IANA… Patrick Dwyer
- Re: [urn] Namespace Identifier: Requested of IANA… Hakala, Juha E
- Re: [urn] Namespace Identifier: Requested of IANA… Patrick Dwyer
- Re: [urn] Namespace Identifier: Requested of IANA… Peter Saint-Andre
- Re: [urn] Namespace Identifier: Requested of IANA… Peter Saint-Andre
- Re: [urn] Namespace Identifier: Requested of IANA… Patrick Dwyer