Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Addressing IESG evaluation feedback #48

Merged
merged 78 commits into from Mar 21, 2022
Merged
Changes from 1 commit
Commits
Show all changes
78 commits
Select commit Hold shift + click to select a range
425ee58
Nits from Éric during IESG evaluation
henkbirkholz Feb 9, 2022
36f9c52
fixed redundant BCP 26 / RFC 8126 ref
henkbirkholz Feb 9, 2022
29057dd
fixing the correct ref entry helps...
henkbirkholz Feb 9, 2022
d59efeb
Adressing Ben's comment (1)
henkbirkholz Feb 17, 2022
9a8c6fa
Addrssing Ben's commnet (8). What a curious oversight.
henkbirkholz Feb 17, 2022
e4aef22
partially addressed Ben's comment #2
henkbirkholz Feb 21, 2022
5744d3b
markdown...
cabo Feb 21, 2022
24e72c9
More updates for Ben#2
cabo Feb 21, 2022
70f3434
Ben#3
cabo Feb 21, 2022
be1172c
Ben #5, IANA
cabo Feb 21, 2022
719ebf5
Ben #7
cabo Feb 21, 2022
767f235
Ben #4
cabo Feb 21, 2022
7842f12
Ben #4
cabo Feb 21, 2022
268bdc2
Fix trailing whitespace
cabo Feb 21, 2022
4106069
Merge branch 'iesg-eval' of github.com:sacmwg/draft-ietf-sacm-coswid …
henkbirkholz Feb 21, 2022
4bbab0e
double quote for merge
henkbirkholz Feb 21, 2022
99df02b
Merge branch 'iesg-eval' of github.com:sacmwg/draft-ietf-sacm-coswid …
henkbirkholz Feb 21, 2022
29ffe13
size and stack update
henkbirkholz Feb 25, 2022
ba33b21
payload and evidence (commment on section 2.3)
henkbirkholz Feb 25, 2022
c5fd9c6
removed the weird monotonic
henkbirkholz Feb 25, 2022
54d2e0c
SHOULD contraints consequences (comment on section 2.4)
henkbirkholz Feb 25, 2022
63ef9aa
more consequences on violating constraints
henkbirkholz Feb 25, 2022
0a24720
uri-schemes in reg-id
henkbirkholz Feb 25, 2022
e3f8af0
Switch do domainprefix/name
cabo Mar 2, 2022
f220b96
some things
henkbirkholz Mar 2, 2022
f353714
Merge branch 'iesg-eval' of github.com:sacmwg/draft-ietf-sacm-coswid …
henkbirkholz Mar 2, 2022
5d7d392
Sec-cons for relative paths
cabo Mar 2, 2022
f1c49bd
Clarify that artifact is an absolute filesystem path
cabo Mar 2, 2022
87fdb84
Clarify base of relative URIs
cabo Mar 2, 2022
eb36b07
typo
cabo Mar 2, 2022
d1ca428
Ben re media-type (Section 2.7)
cabo Mar 2, 2022
8d2ec78
Ben 2.8: String comparison is byte-by-byte
cabo Mar 2, 2022
6df2d87
Ben 2.8: Generator can be a tag-id
cabo Mar 2, 2022
7a3d853
Ben 2.8: Generator can be a tag-id
cabo Mar 2, 2022
93dff88
Ben 2.9.1 ("current" in registry)
cabo Mar 2, 2022
45f0c5f
comment on Section 2.9.1 "parity"
henkbirkholz Mar 2, 2022
ed89780
ownership change in .cddl, too
cabo Mar 2, 2022
7693748
comment file version (index 21)
henkbirkholz Mar 3, 2022
0cd0830
added location to evidence-entry based on the comment on location (in…
henkbirkholz Mar 3, 2022
d77003f
corresponding change in full cddl
henkbirkholz Mar 3, 2022
457ad58
clarify interdependence of location values
cabo Mar 3, 2022
273405b
comment on type (index 29)
henkbirkholz Mar 3, 2022
dab54e7
Explain that indexed label values have a reserved 0
cabo Mar 3, 2022
0ca68e4
Clarify version scheme ordering
cabo Mar 3, 2022
a6a4508
Mark index 30 as unassigned
cabo Mar 3, 2022
8227258
Clarify the use of IDNA labels in domainprefix/name
cabo Mar 3, 2022
c94b7f8
comment on Section 6.2.2
henkbirkholz Mar 3, 2022
55ce7fa
also no "initially"
henkbirkholz Mar 3, 2022
1a1ccf6
made a span a block
henkbirkholz Mar 3, 2022
01d2e0e
Use "criteria" in place of "guidelines" that are more like "rules"...
cabo Mar 3, 2022
00ffc80
SHOULD -> MUST for squatting
cabo Mar 3, 2022
4092a79
Reference 9052-to-be instead of 8152
cabo Mar 3, 2022
af2cb66
Fragment identifier considerations
cabo Mar 3, 2022
54f1e60
Conditionalize magic number
cabo Mar 3, 2022
8ed87fc
Silence xml2rfc a bit more
cabo Mar 3, 2022
904ffe4
fix irregularity
cabo Mar 3, 2022
a6894df
already fixed, typo
cabo Mar 3, 2022
4b09d9e
Ben re 6.7 (-> better define tag-id)
cabo Mar 3, 2022
a46ed91
removed prescriptive key identifier content
henkbirkholz Mar 6, 2022
a9e75a8
improved Section 8 header
henkbirkholz Mar 6, 2022
e3bb265
added an up to date COSE countersign reference
henkbirkholz Mar 6, 2022
4f30db6
Spell checker
cabo Mar 6, 2022
e742103
Discuss cross-algorithm attacks on hashes
cabo Mar 6, 2022
8ba0e9d
added SecCon on suppressed new tags
henkbirkholz Mar 6, 2022
5a4f7d8
Add some seccons references
cabo Mar 6, 2022
497482f
Discuss disclosure, particularly via entitlement keys
cabo Mar 6, 2022
3b03432
Explain that signed ≠ true
cabo Mar 6, 2022
c6ca7fc
Secure key/entity database
cabo Mar 6, 2022
7a63cbe
veracity -> + suitability
cabo Mar 6, 2022
4d732df
use, not create revocation information
cabo Mar 6, 2022
6eced39
tags aren't confidential, but which apply is
cabo Mar 6, 2022
7a2adf0
tag-id collision as an attack
cabo Mar 6, 2022
52063fb
easily discoverable -> by authorized applications and users on an
cabo Mar 6, 2022
d6c7b7b
moved X.1520 to informative
henkbirkholz Mar 6, 2022
8ce75cb
Merge branch 'iesg-eval' of github.com:sacmwg/draft-ietf-sacm-coswid …
henkbirkholz Mar 6, 2022
cdeea43
Ben's nits
cabo Mar 6, 2022
46f25c0
typo
cabo Mar 6, 2022
75e19f4
Merge branch 'iesg-eval' of github.com:sacmwg/draft-ietf-sacm-coswid …
henkbirkholz Mar 6, 2022
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
4 changes: 2 additions & 2 deletions draft-ietf-sacm-coswid.md
Expand Up @@ -1005,10 +1005,10 @@ The following table contains a set of values for use in the concise-swid-tag gro

The values above are registered in the IANA "Software Tag Version Scheme Values" registry defined in Section {{iana-version-scheme}}. Additional entries will likely be registered over time in this registry.

These version schemes have partially overlapping value spaces. The following guidelines help to ensure that the most specific version-scheme is used:
These version schemes have partially overlapping value spaces. A CoSWID producer that is aware of the version scheme behind the version value, it SHOULD include the optional version-scheme item to avoid semantic ambiguity. If the CoSWID producer does not have this information it, SHOULD omit the version-scheme item. The following heuristics can be used by a CoSWID consumer:

- "decimal" and "multipartnumeric" partially overlap in their value space when a value matches a decimal number. When a corresponding software-version item's value falls within this overlapping value space, the "decimal" version scheme SHOULD be used.
- "multipartnumeric" and "semver" partially overlap in their value space when a "multipartnumeric" value matches the semantic versioning syntax. When a corresponding software-version item's value falls within this overlapping value space, the "semver" version scheme SHOULD be used.
- "multipartnumeric" and "semver" partially overlap in their value space when a "multipartnumeric" value matches the semantic versioning syntax. When a corresponding software-version item's value falls within this overlapping value space, the "semver" version scheme SHOULD be assumed.
- "alphanumeric" and other version schemes might overlap in their value space. When a corresponding software-version item's value falls within this overlapping value space, the other version scheme SHOULD be used instead of "alphanumeric".

{: #indexed-entity-role}
Expand Down