Comment Resolution Log CSDPR01 to CS01

[sthagen]

Comment Resolution Log

The table summarizes the comments that were received during the 30-day public review of the committee specification draft "Common Security Advisory Framework Version 2.0" and their resolution. Comments came to the csaf-comment and the CSAF TC mailing lists. The public review did start 14 August 2021 at 00:00 UTC and did end 12 September 2021 at 23:59 UTC.

A status of "Completed" in the Disposition column indicates that the editors have implemented the changes on which the TC decided, which are outlined in the Resolution column. It also is a hyperlink to the GitHub commit notice.

The item number is a hyperlink to the e-mail on the csaf-comment or CSAF TC mailing lists.

The following abbreviations are used:

• SH= Stefan Hagen
• TS = Thomas Schmidt

Item #	Date	Commenter	Description	Date acknowledged	Resolution	Disposition
1	2021-08-24	Eliot Lear	Section 7.1.6: Redirects	2021-08-25	Discussed at TC call	No change required
2	2021-08-24	Eliot Lear	Section 5.1 filename - #343	2021-08-25	Discussed at TC call	No change required
3	2021-08-24	Eliot Lear	Should Section 7 be a part of THIS specification or a separate specification? - #344	2021-08-25	Discussed at TC call	No change required
4	2021-08-24	Eliot Lear	Section 7.1.19: OpenPGP signatures? - #345	2021-08-26	Discussed at TC call	No change required
5	2021-09-01	Christian Keil	Correct links in status section - these point to OpenC2 instead of CSAF TC #354	2021-09-08	Discussed at TC call	Completed
6	2021-09-01	Christian Keil	Extend to product identification helpers to mitigate name / vendor changes? #355	2021-09-08	Discussed at TC call	No change required
7	2021-09-01	Christian Keil	Extend documentation for Notes Type to better guide producers? #356	2021-09-08	Discussed at TC call	No change required
8	2021-09-01	Christian Keil	Consider adding Product Status options for vendors to express that there will be no further investigation #357	2021-09-08	Discussed at TC call	No change required
9	2021-09-01	Christian Keil	Further constraints for semantic version application? #358	2021-09-08	Discussed at TC call	No change required
10	2021-09-08	Duncan Sparrell	Terms legacy, end-of-life, and end-of-support #363	2021-09-28	Discussed at TC call	No change for version 2.0 required
11	2021-09-10	Patrick Fuller	Call for assisted input technology to mitigate complexity and support automation #359	2021-09-11	Discussed at TC call	No change required

Evaluation of Feedback

The editors consider above public comments as well as other more editorial feedback documented in issue #360 and classified/considered per pull request #362 as Non-Material per OASIS TC process.

A motion has been issued to the TC mailing list by Stefan Hagen on 2021-10-10 to promote the resulting revised work products to CS01 including non-material changes only.

To ease verification by anyone and to support the administration a separate release candidate archive containing the 4 standards track work products will be created and linked to this issue as well as noted in the motion to the list.

[sthagen]

@chet-ensign (or @OASIS-OP-Admin) please kindly provide feedback if the motion is formally correct - it feels like ages since I last initiated a promotion from CSD to CS. Thanks.

[sthagen]

@santosomar and @chet-ensign please suggest a way forward for the additional three fixes of typos to be included in any future CS01.

1. Should we amend the motion?
2. Create an additional and separate motion?
3. Should I create a new release candidate archive?

I suggest that I do 3. in any case and would love to chose 1. (as 2. might cost us another week)

Any advice? Thanks.

[santosomar]

Since they are very very minor typos and the fixes do not change the meaning or context of the text, I suggest # 3.

[sthagen]

@santosomar I am currently in consultation with TC administration as there may be a way to shorten the path to the CS01

my reading of the process was too superficial as eg no public review is usually performed when progressing to CS01

I propose we wait for the advice we receive ...

[santosomar]

Sounds good! Thank you so much for all your support and efforts!

[OASIS-OP-Admin]

I agree. Since you are approving a working draft with non-material changes already, might as well fix any that you catch. I will add recommended motion language in a moment.

[OASIS-OP-Admin]

Here is a motion that I think meets your needs. It comes from https://www.oasis-open.org/committees/download.php/53768

I move to approve the Chair requesting that TC Administration hold a Special Majority Vote to approve <Working Draft title, version number and working draft number> contained in as a Committee Specification. I further move that the TC affirm that changes have been made since the last public review, that the changes made are documented in and that the TC judges these changes to be Non-Material in accordance with the definition in the OASIS TC Process (http://www.oasis-open.org/policies-guidelines/tc-process#dNonmaterialChange).

You can then open the request to hold the Special Majority Vote at https://www.oasis-open.org/project-administration-support-requests/form-request-a-special-majority-vote-to-approve-a-specification-with-non-material-changes/

Also, please extract the comment resolution log to an individual file and store it with the other files where I can point to it and download it. We'll need it to load with rest of the files.

[sthagen]

@santosomar, @tschmidtb51, @OASIS-OP-Admin Looking at the calendar with our next scheduled meeting not much more than a week ahead I intend to

1. package the typo fixed version up as an RC2 archive with the matching tag and
2. Create a github „pre-release“ to describe the content and rationale and finally
3. create a motion during the upcoming TC call filling in the placeholders of above example motion.

Thanks to @OASIS-OP-Admin for guiding us through a smooth transition towards Committee Specification level.