Subject: [OPSAWG] small changes for SBOM access draft

From: Eliot Lear <[email-masked]>
Date: Tue, 25 May 2021 14:51:08 +0200

Hi everyone,

There are a few small changes, one that need to be discussed:

  * The current draft needs a slight bit of clarity on what protocols
    can invoke .well-known.  I had some text in there to include a
    schema, but we got rid of it.  I think we went too far.  We still
    want to support all of HTTP(s)/COAP(s), and we can do that with an
    enumeration to indicate which schema should be used.
  * I also think we want to do OpenC2 in the same way, by simply adding
    an enumeration type for it, and then using a different endpoint
    (/.well-known/openc2).

However, to do the latter, we would need to register the new endpoint.  
I don't mind doing it here, but the Oasis people should feel comfortable 
with such an endpoint existing, and Duncan, you might want to apply such 
an addition to your code.  This solves a problem I know that you guys 
were looking at at some point.  If you want to discuss among your OpenC2 
friends, this would be good.  Happy to join in if you like.

Eliot