Subject: [OPSAWG] draft-ietf-opsawg-sbom-access and VEX/CSAF

From: Eliot Lear <[email-masked]>
Date: Fri, 2 Jul 2021 20:57:45 +0200

Hi!

We had started a discussion about having vulnerability information made 
available alongside SBOM information in the draft.  In the last part of 
this discussion, people became concerned that the two concepts would 
become intermixed.  They are, to be sure, related, but one can be 
provided without the other.

What I propose is to introduce both concepts to explain both their 
independence and inter-relation, and then create optional elements for both.

To be clear, one can provide an SBOM and not vulnerability information.  
One can provide vulnerability information and not an SBOM.  One can 
provide both.

The same approach will be taken for both: format neutral.

Ok?

Eliot

---

From: "Dick Brooks" <[email-masked]>
Date: Fri, 2 Jul 2021 15:06:20 -0400

Eliot,

	I like the way you frame the SBOM/VEX discussion as being related, but separate concepts. 

	IMO, an SBOM MUST be present, and a VEX MAY be present. Each one is manifested as separate artifacts/exchanges in the current exchange patterns that are forming.

Thanks,

Dick Brooks

Never trust software, always verify and report! ™
http://www.reliableenergyanalytics.com
Email: [email-masked]
Tel: +1 978-696-1788

-----Original Message-----
From: OPSAWG <[email-masked]> On Behalf Of Eliot Lear
Sent: Friday, July 2, 2021 2:58 PM
To: [email-masked]
Subject: [OPSAWG] draft-ietf-opsawg-sbom-access and VEX/CSAF

Hi!

We had started a discussion about having vulnerability information made available alongside SBOM information in the draft.  In the last part of this discussion, people became concerned that the two concepts would become intermixed.  They are, to be sure, related, but one can be provided without the other.

What I propose is to introduce both concepts to explain both their independence and inter-relation, and then create optional elements for both.

To be clear, one can provide an SBOM and not vulnerability information. One can provide vulnerability information and not an SBOM.  One can provide both.

Ok?

Eliot