Re: [urn] Namespace Identifier: Requested of IANA - cdx

[Patrick Dwyer <[e-mail]>]

Thank you everyone for your time and feedback.

On Tue, Mar 29, 2022 at 7:30 AM Peter Saint-Andre <[e-mail]> wrote:
>
> Hi everyone,
>
> This namespace has now been registered:
>
> https://www.iana.org/assignments/urn-formal/cdx
>
> Peter
>
> On 3/19/22 3:36 PM, Peter Saint-Andre wrote:
> > Hi Pat,
> >
> > Your latest iteration looks good to me (and Dale and Juha), so I think
> > we're ready to proceed. I will follow up with IANA and report back.
> >
> > Peter
> >
> > On 3/19/22 7:26 AM, Patrick Dwyer wrote:
> >> Hi all,
> >>
> >> Is there anything else I need to do to register this URN namespace?
> >>
> >> Regards,
> >> Pat
> >>
> >> On Tue, Feb 1, 2022 at 9:29 PM Hakala, Juha E
> >> <[e-mail]> wrote:
> >>>
> >>> Hello Patrick,
> >>>
> >>> this looks fine; I approve the request.
> >>>
> >>> All the best,
> >>>
> >>> Juha
> >>>
> >>> -----Alkuperäinen viesti-----
> >>> Lähettäjä: urn <[e-mail]> Puolesta Patrick Dwyer
> >>> Lähetetty: tiistai 1. helmikuuta 2022 4.28
> >>> Vastaanottaja: [e-mail]
> >>> Aihe: Re: [urn] Namespace Identifier: Requested of IANA - cdx
> >>>
> >>> Juha, thanks for more great feedback.
> >>>
> >>> Apologies for taking so long to get this revision back to the group.
> >>>
> >>> New version:
> >>>
> >>> Namespace Identifier:  Requested of IANA - cdx
> >>>
> >>> Version: 1
> >>>
> >>> Date: 2022-01-01
> >>>
> >>> Registrant: Patrick Dwyer, on behalf of the OWASP CycloneDX project.
> >>> Email: [e-mail]
> >>> Address:
> >>> The OWASP Foundation Inc.
> >>> 401 Edgewater Place, Suite 600
> >>> Wakefield, MA 01880
> >>>
> >>> Purpose:
> >>>
> >>> CycloneDX is a software bill of materials OWASP standard. CycloneDX
> >>> bill of materials documents (BOMs) are intended to be exchanged
> >>> between different parties of the software supply chain.
> >>>
> >>> URNs in the "cdx" namespace are used as a means of persistently
> >>> identifying CycloneDX BOMs.
> >>>
> >>> When creating a BOM, a CycloneDX URN can be used to reference an
> >>> upstream BOM for a component rather than embedding it inline. This
> >>> may be a consideration for performance reasons. Especially in
> >>> resource constrained environments such as embedded devices. It can
> >>> also be used when a software supplier does not have authority to
> >>> share upstream BOM content directly.
> >>>
> >>> CycloneDX also supports "BOM refs". A BOM ref is a reference to a
> >>> particular element within a BOM. A "cdx" URN with an f-component is a
> >>> BOM ref, with the f-component specifying the location of the element
> >>> within the BOM identified by the URN.
> >>>
> >>> Syntax:
> >>>
> >>> The syntax for a CycloneDX URN namestring is defined using the
> >>> Augmented Backus-Naur Form (ABNF) below. It uses "UUID" as defined in
> >>> [RFC4122] and "f-component" as defined in [RFC3986].
> >>>
> >>>    namestring             = assigned-name [ "#" f-component ]
> >>>    assigned-name          = "urn:cdx:" NSS
> >>>    NSS                    = bom-serial-number "/" bom-version
> >>>    bom-serial-number-uuid = UUID
> >>>    bom-version            = nonzero-digit *digit ; an integer >= 1
> >>>    nonzero-digit          = %x31-39 ; 1-9
> >>>
> >>> Assignment:
> >>>
> >>> CycloneDX URNs are assigned in a decentralised way, using the BOM
> >>> serial number. BOM serial numbers are version 4 UUIDs as defined in
> >>> [RFC4122]. Once assigned, BOM serial numbers are unique and persistent.
> >>>
> >>> Security and Privacy:
> >>>
> >>> As CycloneDX URNs are based on UUIDs they have the same security
> >>> considerations as UUID URNs as per [RFC4122].
> >>>
> >>> Additionally, there are no specification limitations beyond [RFC3986]
> >>> on what can be included in an f-component. Given that f-components
> >>> may be published in CyclineDX URNs, producers of BOMs should avoid
> >>> using any value on which there are sharing restrictions. For
> >>> producers of BOMs who have high confidentiality requirements, it is
> >>> recommended to use UUIDs for f-components.
> >>>
> >>> Interoperability:
> >>>
> >>> Although CycloneDX BOMs may use a UUID URN to identify a BOM via its
> >>> BOM serial number, the serial number isn’t sufficient when
> >>> referencing a BOM because a particular BOM may be revised over time.
> >>> Even in the case of legacy software that is not conceptualized as
> >>> changing, mistakes and omissions can be corrected over time causing
> >>> changes in the BOM. This is allowed for by successive "cdx" URNs in
> >>> which the BOM serial number is static and the version is incremented.
> >>>
> >>>
> >>> On Fri, Jan 21, 2022 at 12:35 PM Dale R. Worley <[e-mail]>
> >>> wrote:
> >>>>
> >>>> Patrick Dwyer <[e-mail]> writes:
> >>>>> Thanks for the great feedback Dale.
> >>>>>
> >>>>> Revised below:
> >>>>>
> >>>>> Namespace Identifier:  Requested of IANA - cdx
> >>>>>
> >>>>> Version:  1
> >>>>>
> >>>>> Date:  2022-01-01
> >>>> [...]
> >>>>
> >>>> That covers everything I thought was an issue.  It looks good to me.
> >>>>
> >>>> Dale
> >>>
> >>> _______________________________________________
> >>> urn mailing list
> >>> [e-mail]
> >>> https://www.ietf.org/mailman/listinfo/urn
> >>
> >> _______________________________________________
> >> urn mailing list
> >> [e-mail]
> >> https://www.ietf.org/mailman/listinfo/urn
> >
>