Can we cite FIPS PUB 180-4, Secure Hash Standard, as normative?

[ghost]

Copied from sarif-standard/sarif-spec-v1#11, created by @lgolding:

[michaelcfanning]

I believe we can cite this reference as normative. The SARIF spec mandates that producers who populate file object with hash details provide hash values that comply with this normative spec.

[ghost]

@michaelcfanning I opened this issue when we thought we were going to ISO, and ISO has really strict rules on what you can cite as normative. We're going to OASIS so this is moot. If we send this to ISO later on and they call us on this, that's plenty of time to address it then.