Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CoSWID triple needs transformation and processing sections #328

Open
nedmsmith opened this issue Oct 16, 2024 · 1 comment
Open

CoSWID triple needs transformation and processing sections #328

nedmsmith opened this issue Oct 16, 2024 · 1 comment

Comments

@nedmsmith
Copy link
Collaborator

CoSWID triples coswid-triple-record needs a transformation section and possibly a processing section. The transformation section will map contents of a coswid tag to internal representations for evidence, reference, and endorsements. If the mapping comes up with gaps (something that doesn't map) then a processing section may be needed.

CoSWID field mappings are as follows:
payload-entry : Reference Values
evidence-entry : Evidence
software-meta.activation-status : Evidence? (if so, how should it be reported since concise-evidence omits it)
channel-type : Endorsement
colloquial-version : Endorsement
description : Endorsement
edition : Endorsement
entitlement-data-required : ??? (feels like policy)
entitlement-key : Endorsement
generator : tag info
persistent-id : Should be used in the construction of Environment-maps
product : Endorsement
product-family : Endorsement
revision : Endorsement
summary : Endorsement
unspsc-code : Endorsement
unspsc-version : Endorsement

Extension to sw meta should describe their internal representation mapping / transformation.

Concise Swid Tag:
software-name : Endorsement
software-version : Endorsement
version-scheme : Endorsement
media : Endorsement (for example, it may contain a stringified representation of environment-map)

All other members of concise-swid-tag are tag specific.

@deeglaze
Copy link
Collaborator

What form of evidence is expected for communicating software information in a module at the granularity of CoSWIDs? Is there a real usage of this triple that the spec can reference to point a reader at something plausible?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants