Comment Resolution Log CSDPR02 to CS02

[sthagen]

Comment Resolution Log

The table summarizes the comments that were received during the 15-day public review of the committee specification draft "Common Security Advisory Framework Version 2.0" and their resolution. Comments came to the csaf-comment and the CSAF TC mailing lists. The public review did start 15 April 2022 at 00:00 UTC and did end 29 April 2022 at 23:59 UTC.

A status of "Completed" in the Disposition column indicates that the editors have implemented the changes on which the TC decided, which are outlined in the Resolution column. It also is a hyperlink to the GitHub commit notice.

The item number is a hyperlink to the issue number in this OASIS TC CASF repository at https://github.com/oasis-tcs/csaf/.

Item #	Date	Commenter	Description	Date acknowledged	Resolution	Disposition
1	2022-04-27	Thomas Proell	Remediations are confusing	2022-04-27	Discussed at TC call	TC agrees. Editors added clarifications and explanations as needed.
2	2022-04-27	Thomas Schmidt	Clarify aggregator requirements	2022-04-27	Discussed at TC call	TC agrees. Editors added clarifications and explanations as needed.
3	2022-04-27	Thomas Schmidt	Prettify Note	2022-04-27	Discussed at TC call	TC agrees. Editors added clarifications and explanations as needed.
4	2022-04-27	Thomas Schmidt	Improve title of mandatory test 6.1.30	2022-04-27	Discussed at TC call	TC agrees. Editors added clarifications and explanations as needed.
5	2022-04-27	Thomas Schmidt	Add missing reference [VERS]	2022-04-27	Discussed at TC call	TC agrees. Editors added clarifications and explanations as needed.
6	2022-04-27	Thomas Schmidt	Add missing reference [VEX-Just]	2022-04-27	Discussed at TC call	TC agrees. Editors added clarifications and explanations as needed.
7	2022-04-27	Thomas Schmidt	Add missing ] in example 16	2022-04-27	Discussed at TC call	TC agrees. Editors added clarifications and explanations as needed.
8	2022-04-27	Thomas Schmidt	Clarify purpose of product_id	2022-04-27	Discussed at TC call	TC agrees. Editors added clarifications and explanations as needed.
9	2022-04-27	Thomas Schmidt	Clarify purpose of group_ids	2022-04-27	Discussed at TC call	TC agrees. Editors added clarifications and explanations as needed.
10	2022-04-27	Thomas Schmidt	Clarify binding already in section 3	2022-04-27	Discussed at TC call	TC agrees. Editors added clarifications and explanations as needed.
11	2022-04-28	Thomas Schmidt	Reference security.txt as RFC9116	2022-04-28	Discussed at TC call	TC agrees. Editors added clarifications and explanations as needed.
12	2022-04-28	Thomas Schmidt	Fix leftover }	2022-04-28	Discussed at TC call	TC agrees. Editors added clarifications and explanations as needed.
13	2022-04-28	Thomas Schmidt	Fix example 4	2022-04-28	Discussed at TC call	TC agrees. Editors added clarifications and explanations as needed.

Evaluation of Feedback

The editors consider above public comments as well as other more editorial feedback documented in issue(s) ... and classified/considered per pull request ... as Non-Material per OASIS TC process.

A motion has been issued during the TC meeting by Stefan Hagen on 2022-05-18 to promote the resulting revised work products to CS02 including non-material changes only.

To ease verification by anyone and to support the administration a separate release candidate archive containing the 4 standards track work products has been created and linked to this issue as well as noted in the motion as annotation in the minutes of meeting.

[santosomar]

Updated the issue to include the link to the May 18, 2022 meeting minutes: https://github.com/oasis-tcs/csaf/blob/master/meeting_minutes/2022-05-18.md

[tschmidtb51]

PR for the missing link has been added: #556.

[sthagen]

@santosomar, @tschmidtb51, @chet-ensign The public review comment resolution log (CRL) is at https://github.com/oasis-tcs/csaf/blob/master/csaf_2.0/comment_resolution/log_from_csdpr02.md side by side with the log from CSDPR01. Now everything should be in place for progressing. Note: The CRL only documents the comments received during public review of CSD02 (CSDPR02) - additional non-material changes have been documented per the additional entries in the minutes of the previous TC meeting at https://github.com/oasis-tcs/csaf/blob/master/meeting_minutes/2022-05-18.md

@chet-ensign: Question: Do we need to replace the GitHub handle of @tom1972-de with a real "Given Family" name entry in the CRL to satisfy the OASIS TC Process requirements?

[chet-ensign]

Hi Stefan, Yes, please change the Github name to a given family name. Also, please prep a stand-alone version of this document. Paul, do you have a pipeline for converting an md file into PDF that can be used here? Stefan, I am OK with using a link from the item number to the Gh issue documenting the comment. However, please change the "Completed" into a short statement of what the TC decided to do. For example, on the first row, a short statement like "TC agrees. Editors added clarifications and explanations as needed." Keep them linked to the issues for more detail, of course, but someone should be able to look at the file and know, at a high level, what the TC decided. Let me know if you have any questions on this. Thanks, /chet

…

On Sun, May 29, 2022 at 6:55 AM Stefan Hagen ***@***.***> wrote: @santosomar <https://github.com/santosomar>, @tschmidtb51 <https://github.com/tschmidtb51>, @chet-ensign <https://github.com/chet-ensign> The public review comment resolution log (CRL) is at https://github.com/oasis-tcs/csaf/blob/master/csaf_2.0/comment_resolution/log_from_csdpr02.md side by side with the log from CSDPR01. Now everything should be in place for progressing. Note: The CRL only documents the comments received during public review of CSD02 (CSDPR02) - additional non-material changes have been documented per the additional entries in the minutes of the previous TC meeting at https://github.com/oasis-tcs/csaf/blob/master/meeting_minutes/2022-05-18.md @chet-ensign <https://github.com/chet-ensign>: Question: Do we need to replace the GitHub handle of @tom1972-de <https://github.com/tom1972-de> with a real "Given Family" name entry in the CRL to satisfy the OASIS TC Process requirements? — Reply to this email directly, view it on GitHub <#554 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACYUWRJUNML5OBLVEDPAG6TVMNEINANCNFSM5WPOPCCA> . You are receiving this because you were mentioned.Message ID: ***@***.***>

-- Chet Ensign Chief Technical Community Steward OASIS Open +1 201-341-1393 <+1+201-341-1393> ***@***.*** www.oasis-open.org

[sthagen]

@chet-ensign @santosomar @tschmidtb51 I created a release at https://github.com/oasis-tcs/csaf/releases/tag/cs-02-20220330-rc1 - please do not hesitate to ask if there are still questions or items missing. Thanks

[sthagen]

@chet-ensign I also added some PDF rendition of the log at https://github.com/oasis-tcs/csaf/releases/download/cs-02-20220330-rc1/log_from_csdpr02.pdf to the release (updated the resolution log related list item (and placed a checksum file in addition for what it is worth).

Hope it helps,
Stefan

[tschmidtb51]

@sthagen I guess we can close this one as the CS02 is published, right?