How do we use semver to reference versions of the trees etc?

[ahouseholder]

@j--- asks in a comment in #246

How do we use semver to reference versions of the trees etc?
One option is that each suggested tree inherits the version of SSVC? I didn't address this in https://github.com/CERTCC/SSVC/blob/main/doc/style-guide-how-to.
If we use SemVer, then I would imagine major versions break backwards compatibility by changing decision point definitions, changes to scope or other fundamental definitions, etc. Minor versions are meaningful changes to recommended decision trees? And then bug fixes are everything else?
Does this mean we need the version number represented within the file or file metadata somehow?

Originally posted by @j--- in #246 (comment)

Resolving this issue requires resolving the following items:

• What are the versioned objects in SSVC? #289
• Defining tree versions #303

[j---]

@jeroenh I feel like you might have productive thoughts on this question.

[jeroenh]

I think the reasoning you show there makes sense.

After a 2.0 version of something you usually get a better sense of where you're going and have some idea of the kind of things you still want to change, and a bigger update you want to do later that might be incompatible.
So as long as "users" of SSVC are not affected by a change in a big way, I would say that you use minor versions, and use major versions with incompatible changes.

I would recommend to add a summary of this outcome to the main README.md so that users are aware.

[j---]

related to #261 , if we are going to move towards having many more example trees that are not strictly linked to a stakeholder, how do we name trees in general?

[ahouseholder]

This issue is extended / possibly blocked by Discussion #289.

[ahouseholder]

Depends on

• Document Decision Point Versioning Rules #322
• Document Decision Tree versioning rules #323

[ahouseholder]

fixed by

• add ADR proposals for decision point versioning. #350
• Add Decision Point Group Versioning ADRs #368
• Clarify Decision Point Versioning rules (revises ADR 0003 into ADR 0006) #369