Draft: draft-ietf-sacm-coswid

Commentary: Cleaned up IANA registrations , fixing some inconsistencies in the table labels . dded additional CDDL sockets for resource collection entries providing for additional extension points to address future SWID / CoSWID extensions . Updated section on extension points to address new CDDL sockets and to reference the new IANA registry for items . Removed unused references and new references to address placeholder comments . Also : Added changelog entries . Updated inline CDDL . Normalized use of links in the markdown .
Paragraph (version A):
The following is an excerpt (with some modifications and reordering)
from NIST Interagency Report (NISTIR) 8060: Guidelines for the
Creation of Interoperable SWID Tags SWID-GUIDANCE, which describes
the tag types used within the lifecycle defined in ISO-19770-2:2015.
This information is included here to provide a concise reference for
the use of CoSWIDs in the software lifecycle.
Paragraph (version B):
The following is an excerpt (with some modifications and reordering)
from NIST Interagency Report (NISTIR) 8060: Guidelines for the
Creation of Interoperable SWID Tags SWID-GUIDANCE, which describes
the tag types used within the lifecycle defined in ISO-19770-2:2015.
This information is included here to provide a succinct description
of the use of CoSWIDs in the software lifecycle.  Understanding the
use of CoSWIDs in the software lifecycle provides a basis for
understanding the information provided in a CoSWID and the associated
semantics of this information.
Paragraph (version A):
Note: The type of a tag is determined by specific data elements,
which is discussed in model-tag-type.
Paragraph (version B):
The type of a tag is determined by specific data elements, which is
discussed in semantics-tag-type.
Paragraph (version A):
The explicit definition of types for attributes that are typically
stored in the "any attribute" of an ISO-19770-2:2015 in XML
representation.  These are covered in model-global-attributes and
[model-any-element] of this document.
Paragraph (version A):
CoSWID Extension - Used to add new information structures to a
CoSWID (defined in model-concise-software-identity).
Paragraph (version A):
Entity Extension - Used to add new new information structures
to an entity (defined in model-entity).
Paragraph (version A):
Payload Extension - Used to add new new information structures
to a payload, such as new payload resource types (defined in
model-payload).
Paragraph (version A):
Evidence Extension - Used to add new new information structures
to an evidence, such as new evidence resource types (defined in
model-evidence).
Paragraph (version B):
The explicit definition of types for attributes that are typically
stored in the "any attribute" of an ISO-19770-2:2015 in XML
representation.  These are covered in model-global-attributes.
Paragraph (version B):
The inclusion of extension points in the CoSWID data definition
using CDDL sockets (see I-D.ietf-cbor-cddl section 3.9).  These
extension points allow for well-formed extensions to be defined in
additional CDDL descriptions that support additional uses of
CoSWID tags that go beyond the original scope of ISO-19770-2:2015
tags.  The following extension points are defined in this
document, which allow the addition of new information structures
to their respective object.
Paragraph (version B):
The CoSWID Items Registry defined in iana-coswid-items provides a
registration mechanism for new items, and associated index values,
added to the CoSWID model through the use of the CDDL sockets
described above.  This registration mechanism will provide for well-
known index values for CoSWID extensions, allowing these index values
to be recognized by implementations supporting a given extension.
Paragraph (version A):
version-scheme (label 14): An 8-bit integer or textual value
representing the versioning scheme used for the software-version
item.  If an integer value is used it MUST be a value from the
registry (see section iana-version-scheme or a value in the
private use range: 32768-65,535.
Paragraph (version A):
media (label 10): This text value is a hint to the tag consumer to
understand what this tag applies to.  This item represents a query
as defined by the W3C Media Queries Recommendation (see
http://www.w3.org/TR/css3-mediaqueries/).  A hint to the consumer
of the link to what the target item is applicable for.  Described
in model-media.
Paragraph (version A):
software-meta-entry (label 5): An open-ended map of key/value data
pairs.  A number of predefined keys can be used within this item
providing for common usage and semantics across the industry.  The
data definition of this entry allows for any additional attribute
to be included, though it is recommended that industry norms for
new attributes are defined and followed to the degree possible.
Described in model-software-meta.
Paragraph (version B):
version-scheme (label 14): An 8-bit integer or textual value
representing the versioning scheme used for the software-version
item.  If an integer value is used it MUST be a value from the
registry (see section iana-version-scheme or a value in the
private use range: 32768-65535.
Paragraph (version B):
media (label 10): This text value is a hint to the tag consumer to
understand what this tag applies to.  This item represents a query
as defined by the W3C Media Queries Recommendation (see W3C.REC-
css3-mediaqueries-20120619).  A hint to the consumer of the link
to what the target item is applicable for.
Paragraph (version B):
software-meta (label 5): An open-ended map of key/value data
pairs.  A number of predefined keys can be used within this item
providing for common usage and semantics across the industry.  The
data definition of this entry allows for any additional attribute
to be included, though it is recommended that industry norms for
new attributes are defined and followed to the degree possible.
Described in model-software-meta.
Paragraph (version A):
entity-entry (label 2): Provides information about one or more
organizations related to the software component referenced by this
CoSWID tag.  Described in model-entity.
Paragraph (version A):
link-entry (label 4): Provides a means to establish relationship
arcs between the tag and another items.  A given link can be used
to establish the relationship between tags or to reference another
resource that is related to the CoSWID tag, e.g.  vulnerability
database association, ROLIE feed , MUD resource , software
download location, etc).  This is modeled after the HTML "link"
element.  Described in model-link.
Paragraph (version A):
payload-entry (label 6): This item represents the software
artifacts that may be installed on an endpoint when the software
component is installed.  Note that the payload may represent a
superset of the software artifacts installed.  Based on user
selections at install time, an installation may not include every
artifact that could be created or executed on the endpoint when
the software component is installed (i.e. if a particular optional
sub-component is not installed, the files associated with that
software component may be included in payload, but not installed
in the system entity).  Described in model-payload.
Paragraph (version B):
entity (label 2): Provides information about one or more
organizations related to the software component referenced by this
CoSWID tag.  Described in model-entity.
Paragraph (version B):
link (label 4): Provides a means to establish relationship arcs
between the tag and another items.  A given link can be used to
establish the relationship between tags or to reference another
resource that is related to the CoSWID tag, e.g.  vulnerability
database association, ROLIE feed RFC8322, MUD resource RFC8520,
software download location, etc).  This is modeled after the HTML
"link" element.  Described in model-link.
Paragraph (version B):
payload (label 6): This item represents the software artifacts
that may be installed on an endpoint when the software component
is installed.  Note that the payload may represent a superset of
the software artifacts installed.  Based on user selections at
install time, an installation may not include every artifact that
could be created or executed on the endpoint when the software
component is installed (i.e. if a particular optional sub-
component is not installed, the files associated with that
software component may be included in payload, but not installed
in the system entity).  Described in model-payload.
Paragraph (version A):
any-element-entry (label 7): A default map that can contain
arbitrary map members and even nested maps (which would also be
any-elements).  In essence, the any-element allows items not
defined in this CDDL data definition to be included in a Concise
Software Identifier.  Described in [model-any-element].
Paragraph (version A):
The operational model for SWID and CoSWID tags was introduced in
intro-lifecycle.  The following rules can be used to determine the
type of a CoSWID tag.
Paragraph (version A):
If a patch modifies the version number or the descriptive metadata of
the software, then a new tag representing these details SHOULD be
installed, and the old tag SHOULD be removed.
Paragraph (version A):
If the patch item is set to "true", the tag SHOULD contain at
least one link with the rel(ation) item value of "patches" and an
href item specifying an association with the software that was
patched.
Paragraph (version A):
If the supplemental item is set to "true", the tag SHOULD contain
at least one link with the rel(ation) item value of "supplements"
and an href item specifying an association with the software that
is supplemented.
Paragraph (version B):
The following co-constraints apply to the information provided by a
concise-software-identity Object.
Paragraph (version B):
If the patch item is set to "true", the tag SHOULD contain at
least one link item with the rel(ation) item value of "patches"
and an href item specifying an association with the software that
was patched.
Paragraph (version B):
If the supplemental item is set to "true", the tag SHOULD contain
at least one link item with the rel(ation) item value of
"supplements" and an href item specifying an association with the
software that is supplemented.
Paragraph (version A):
The following describes each child item of this object.
Paragraph (version A):
media (index 10): See media defined in model-media.
Paragraph (version B):
media (index 10): See media defined in model-concise-software-
identity.
Paragraph (version A):
Note that this representation of version is typically used to
identify a group of specific software releases that are part of
the same release/support infrastructure (i.e.  Fabrikam Office
2013).  This version is used for string comparisons only and is
not compared to be an earlier or later release (that is done via
the entity version).
Paragraph (version B):
Note that this representation of version is typically used to
identify a group of specific software releases that are part of
the same release/support infrastructure (i.e.  Fabrikam Office
2013).  This version is used for string comparisons only and is
not compared to be an earlier or later release (that is done via
the concise-software-identity object's software-version item).
Paragraph (version A):
The number used as a value for hash-alg-id MUST refer an ID in the
Named Information Hash Algorithm Registry; other hash algorithms MUST
NOT be used.  The hash-value MUST represent the raw hash value of the
hashed resource generated using the hash algorithm indicated by the
hash-alg-id.
Paragraph (version B):
The number used as a value for hash-alg-id MUST refer an ID in the
Named Information Hash Algorithm Registry (see
https://www.iana.org/assignments/named-information/named-
information.xhtml); other hash algorithms MUST NOT be used.  The
hash-value MUST represent the raw hash value of the hashed resource
generated using the hash algorithm indicated by the hash-alg-id.
Paragraph (version B):
The operational model for SWID and CoSWID tags was introduced in
intro-lifecycle.  The following additional rules apply to the use of
CoSWID tags to ensure that created tags properly implement this
lifecycle.
Paragraph (version B):
The following rules can be used to determine the type of a CoSWID
tag.
Paragraph (version A):
Integer indices for SWID content attributes and information
elements.
Paragraph (version A):
Content-Type for CoAP to be used in COSE.
Paragraph (version B):
This document uses integer values as index values in CBOR maps.
Paragraph (version B):
All negative values are reserved for Private Use.
Paragraph (version B):
Initial registrations for the CoSWID Items Registry are provided
below.  Assignments consist of an integer index value, the item name,
and a reference to the defining specification.
Paragraph (version A):
Initial registrations for the SWID/CoSWID Version Schema Values
registry are provided below.
Paragraph (version B):
Initial registrations for the SWID/CoSWID Version Schema Values
registry are provided below.  Assignments consist of an integer index
value, the version scheme name, and a reference to the defining
specification.
Paragraph (version B):
Initial registrations for the SWID/CoSWID Entity Role Values registry
are provided below.  Assignments consist of an integer index value, a
role name, and a reference to the defining specification.
Paragraph (version B):
Initial registrations for the SWID/CoSWID Entity Role Values registry
are provided below.  Assignments consist of an integer index value,
the link use name, and a reference to the defining specification.
Paragraph (version B):
Reduced representation complexity of the media-entry type and
removed the section describing the older data structure.
Paragraph (version B):
Reordering of attribute name to integer label by priority
according to semantics.
Paragraph (version B):
Added an IANA registry for CoSWID items supporting future
extension.
Paragraph (version B):
Cleaned up IANA registrations, fixing some inconsistencies in the
table labels.
Paragraph (version B):
Added additional CDDL sockets for resource collection entries
providing for additional extension points to address future SWID/
CoSWID extensions.
Paragraph (version B):
Updated section on extension points to address new CDDL sockets
and to reference the new IANA registry for items.
Paragraph (version B):
Removed unused references and added new references to address
placeholder comments.