Draft: draft-ietf-sacm-coswid

Commentary: Removed IANA registrations for swid and swidpath and updated text to note these are not technically URIs but just expressions using URI syntax .
Paragraph (version A):
a URI with "swid:" as the scheme refers to another SWID or
CoSWID by the referenced tag's tag-id.  This URI needs to be
resolved in the context of the endpoint by software that can
lookup other SWID or CoSWID tags.  For example, "swid:2df9de35-
0aff-4a86-ace6-f7dddd1ade4c" references the tag with the tag-id
value "2df9de35-0aff-4a86-ace6-f7dddd1ade4c".
Paragraph (version A):
a URI with "swidpath:" as the scheme, which refers to another
software tag via an XPATH query W3C.REC-xpath20-20101214 that
matches items in that tag (uri-scheme-swidpath).  This scheme
is provided for compatibility with SWID.  This specification
does not define how to resolve an XPATH query in the context of
CBOR, see uri-scheme-swidpath.
Paragraph (version B):
a URI-like expression with "swid:" as the scheme refers to
another SWID or CoSWID by the referenced tag's tag-id.  This
expression needs to be resolved in the context of the endpoint
by software that can lookup other SWID or CoSWID tags.  For
example, "swid:2df9de35-0aff-4a86-ace6-f7dddd1ade4c" references
the tag with the tag-id value "2df9de35-0aff-
4a86-ace6-f7dddd1ade4c".
Paragraph (version B):
a URI-like expression with "swidpath:" as the scheme, which
refers to another software tag via an XPATH query W3C.REC-
xpath20-20101214 that matches items in that tag (uri-scheme-
swidpath).  This scheme is provided for compatibility with
SWID.  This specification does not define how to resolve an
XPATH query in the context of CBOR, see uri-scheme-swidpath.
Paragraph (version A):
rel (index 40): An integer or textual value that (integer label
with text escape, see data-def, for the "Software ID Link Link
Relationship Values" registry indexed-link-ownership) identifies
the relationship between this CoSWID and the target resource
identified by the "href" item.  If an integer value is used it
MUST be an index value in the range -256 to 65535.  Integer values
in the range -256 to -1 are reserved for testing and use in closed
environments (see iana-private-use).  Integer values in the range
0 to 65535 correspond to registered entries in the IANA "Software
ID Link Relationship Values" registry (see iana-link-rel).  If a
string value is used it MUST be either a private use name as
defined in iana-private-use or a "Relation Name" from the IANA
"Link Relation Types" registry: https://www.iana.org/assignments/
link-relations/link-relations.xhtml as defined by RFC8288.  When a
string value defined in the IANA "Software ID Link Relationship
Values" registry matches a Relation Name defined in the IANA "Link
Relation Types" registry, the index value in the IANA "Software ID
Link Relationship Values" registry MUST be used instead, as this
relationship has a specialized meaning in the context of a CoSWID
tag.  String values correspond to registered entries in the
"Software ID Link Relationship Values" registry.
Paragraph (version B):
rel (index 40): An integer or textual value that (integer label
with text escape, see data-def, for the "Software Tag Link
Relationship Values" registry indexed-link-ownership) identifies
the relationship between this CoSWID and the target resource
identified by the "href" item.  If an integer value is used it
MUST be an index value in the range -256 to 65535.  Integer values
in the range -256 to -1 are reserved for testing and use in closed
environments (see iana-private-use).  Integer values in the range
0 to 65535 correspond to registered entries in the IANA "Software
Tag Link Relationship Values" registry (see iana-link-rel.  If a
string value is used it MUST be either a private use name as
defined in iana-private-use or a "Relation Name" from the IANA
"Link Relation Types" registry: https://www.iana.org/assignments/
link-relations/link-relations.xhtml as defined by RFC8288.  When a
string value defined in the IANA "Software Tag Link Relationship
Values" registry matches a Relation Name defined in the IANA "Link
Relation Types" registry, the index value in the IANA "Software
Tag Link Relationship Values" registry MUST be used instead, as
this relationship has a specialized meaning in the context of a
CoSWID tag.  String values correspond to registered entries in the
"Software Tag Link Relationship Values" registry.
Paragraph (version A):
use (index 42): An integer or textual value (integer label with
text escape, see data-def, for the "Software ID Link Link
Relationship Values" registry indexed-link-ownership) used to
determine if the referenced software component has to be installed
before installing the software component identified by the COSWID
tag.  If an integer value is used it MUST be an index value in the
range -256 to 255.  Integer values in the range -256 to -1 are
reserved for testing and use in closed environments (see iana-
private-use).  Integer values in the range 0 to 255 correspond to
registered entries in the IANA "Link Use Values" registry (see
iana-link-use).  If a string value is used it MUST be a private
use name as defined in iana-private-use.  String values correspond
to registered entries in the "Software ID Link Use Values"
registry.
Paragraph (version B):
use (index 42): An integer or textual value (integer label with
text escape, see data-def, for the "Software Tag Link Relationship
Values" registry indexed-link-ownership) used to determine if the
referenced software component has to be installed before
installing the software component identified by the COSWID tag.
If an integer value is used it MUST be an index value in the range
-256 to 255.  Integer values in the range -256 to -1 are reserved
for testing and use in closed environments (see iana-private-use).
Integer values in the range 0 to 255 correspond to registered
entries in the IANA "Link Use Values" registry (see iana-link-use.
If a string value is used it MUST be a private use name as defined
in iana-private-use.  String values correspond to registered
entries in the "Software Tag Link Use Values" registry.
Paragraph (version A):
This specification defines the following URI schemes for use in
CoSWID and to provide interoperability with schemes used in SWID.
Paragraph (version A):
Note: These URI schemes are used in SWID without an IANA
registration.  The present specification ensures that these URI
schemes are properly defined going forward.
Paragraph (version A):
There is a need for a scheme name that can be used in URIs that point
to a specific software tag by that tag's tag-id, such as the use of
the link entry as described in model-link.  Since this scheme is used
both in a standards track document and an ISO standard, this scheme
needs to be used without fear of conflicts with current or future
actual schemes.  In swid-reg, the scheme "swid" is registered as a
'permanent' scheme for that purpose.
Paragraph (version A):
URIs specifying the "swid" scheme are used to reference a software
tag by its tag-id.  A tag-id referenced in this way can be used to
identify the tag resource in the context of where it is referenced
from.  For example, when a tag is installed on a given device, that
tag can reference related tags on the same device using URIs with
this scheme.
Paragraph (version A):
For URIs that use the "swid" scheme, the scheme specific part MUST
consist of a referenced software tag's tag-id.  This tag-id MUST be
URI encoded according to RFC3986.
Paragraph (version A):
There is a need for a scheme name that can be used in URIs to
identify a collection of specific software tags with data elements
that match an XPath expression, such as the use of the link entry as
described in model-link.  The scheme named "swidpath" is used for
this purpose in SWID, but not registered.  To enable usage without
fear of conflicts with current or future actual schemes, the present
document registers it as a 'permanent' scheme for that purpose (see
swidpath-reg).
Paragraph (version A):
URIs specifying the "swidpath" scheme are used to filter tags out of
a base collection, so that matching tags are included in the
identified tag collection.  The XPath expression W3C.REC-
xpath20-20101214 references the data that must be found in a given
software tag out of base collection for that tag to be considered a
matching tag.  Tags to be evaluated (the base collection) include all
tags in the context of where the "swidpath URI" is referenced from.
For example, when a tag is installed on a given device, that tag can
reference related tags on the same device using a URI with this
scheme.
Paragraph (version B):
This specification defines the following expressions for use in
CoSWID and to provide interoperability with schemes used in SWID.
Because both the "swid" and "swidpath" schemes are to be interpreted
within a local, rather than a global, context, neither of these
scheme are URIs as defined in RFC3986 and the swid and swidpath
scheme names are not registered as permanent schemes with IANA.  That
noted, swid and swidpath expressions conform to all rules for URI
syntax.  All uses of these expressions encountered within a CoSWID
are to be interpreted as described in this section.
Paragraph (version B):
Expressions specifying the "swid" scheme are used to reference a
software tag by its tag-id.  A tag-id referenced in this way can be
used to identify the tag resource in the context of where it is
referenced from.  For example, when a tag is installed on a given
device, that tag can reference related tags on the same device using
expressions with this scheme.
Paragraph (version B):
For expressions that use the "swid" scheme, the scheme specific part
MUST consist of a referenced software tag's tag-id.  This tag-id MUST
be URI encoded according to RFC3986 Section 2.1.
Paragraph (version B):
Expressions specifying the "swidpath" scheme are used to filter tags
out of a base collection, so that matching tags are included in the
identified tag collection.  The XPath expression W3C.REC-
xpath20-20101214 references the data that must be found in a given
software tag out of base collection for that tag to be considered a
matching tag.  Tags to be evaluated (the base collection) include all
tags in the context of where the swidpath expression is referenced
from.  For example, when a tag is installed on a given device, that
tag can reference related tags on the same device using an expression
with this scheme.
Paragraph (version A):
The ISO 19770-2:2015 SWID specification describes use of the "swid"
and "swidpath" URI schemes, which are currently in use in
implementations.  This document continues this use for CoSWID.  The
following subsections provide registrations for these schemes in to
ensure that a permanent registration exists for these schemes that is
suitable for use in the SWID and CoSWID specifications.
Paragraph (version A):
URI schemes are registered within the "Uniform Resource Identifier
(URI) Schemes" registry maintained at IANA.uri-schemes.
Paragraph (version A):
IANA is requested to register the URI scheme "swid".  This
registration request complies with RFC7595.
Paragraph (version A):
IANA is requested to register the URI scheme "swidpath".  This
registration request complies with RFC7595.