Subject: [sacm] [draft-ietf-sacm-terminology] Software package, software component, software instance (#18)

From: llorenzin <[email-masked]>
Date: Tue, 21 Jul 2015 05:37:46 -0700

During the requirements working session this morning, we discussed the difference between a software component and a software instance, which are defined in the information model but not (yet) in the terminology draft.  Looking more closely at the information model, I think there is still some clarification required here.  

My initial impression was that a "software component" is a software package installed on an endpoint, with a unique serial number (i.e. Microsoft Word 2013, product ID $foo) and a "software instance" is a running instance of the software component (i.e. one logged-in user has one instance and another logged-in user has another instance).

However, upon re-reading the definitions in information model section 4.2, it seems to indicate that a "software component" is the _generic_ software package (i.e. Microsoft Word 2013) and a "software instance" is the software package installed on the endpoint with the unique serial number (ie.e Microsoft Word 2013, product ID $foo).  Is that the intent?  If so, then my previous understanding (up to and including this morning's requirements session) was incorrect, and it seems like a confusing use of the term instance.

I propose we consider creating three separate terms here:

Software package: a _generic_ software package (i.e. Microsoft Word 2013) 
Software component: a software package installed on an endpoint, including a unique serial number if present (ie.e Microsoft Word 2013, product ID $foo) 
Software instance: a running instance of the software component (i.e. on a multi-user system, one logged-in user has one instance of Word running and another logged-in user has another instance of Word running, or on a single-user system, a user could have multiple independent instances of a single software component running).

The information model currently says that a software component can be an asset, and it does not say whether a software instance can be an asset.  If we use the three definitions above, I believe we need state that both a software package and a software component instance can be an asset.  (For example, an audit may require identification of software packages _and_ their unique serial numbers to ensure that serial numbers are not re-used across multiple machines.)  I don't have an opinion one way or the other on whether a software instance is also an asset.

---
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-terminology/issues/18