Subject: [sacm] Proto-consensus: Application location

From: "Schmidt, Charles M." <[email-masked]>
Date: Thu, 19 May 2016 19:40:26 +0000

Hello all,

Between the discussions at IETF 95 and the virtual interim yesterday, there
appears to be "in room" consensus on a few proposed updates and expansions
to SWID M&A. As no IETF consensus is complete without mailing-list
consensus, I'm sending out messages on each point of proto-consensus.  

The topic of application location was discussed at the virtual interim on
Tuesday, May 17. SWID tags indicate that a given software product (and a
specific version thereof) is installed on an endpoint. SWID tags generally
do not indicate where this product has been installed. Authoritative tags
(i.e., tags published by a software vendor) never indicate this, and tags
generated locally might or might not include this information. Multiple
consumers of endpoint inventory information might find the location of an
installed software product to be useful. The location of a software product
could also be useful to resolve double-reporting issues: for example, if a
SWID-PC delivers SWID tags gathered from the file system and also SWD tags
generated by an package management tool, it is possible that a single
product instance could be reported by a tag from both of these sources. A
SWID-PV would need to determine whether this double reporting indicated a
single installation reported twice, or two separate installations of the
same software product. If the install location of the associated software
product was reported, this would make it far easier for the SWID-PV to
answer this question. 

The only concern about including an application's installation location is
that this might not be discoverable in most cases. In many cases it will be:
package managers and inventory scanner tools will know this information, and
2015 SWID tags are required to be placed in a sub-directory of the product
itself. However, 2009 SWID tags and other sources of inventory information
can be divorced from the location of the reported product and re-linking
them could be difficult. Despite this, the consensus in the room at the
virtual interim was to include application location when reporting SWID
tags, provided that a failure to resolve the location of an application
produced something that denoted "LOCATION UNKNOWN" rather than an incorrect
location.

Are there any concerns or questions about adding support for application
location to the SWID tag reporting records, or is the online consensus
support for this change?

Thanks,
Charles

---

From: "Waltermire, David A. (Fed)" <[email-masked]>
Date: Thu, 19 May 2016 20:42:00 +0000

If unknown, could the location point to the location of the SWID tag instead? This would provide more information than something like "LOCATION UNKNOWN".

Regards,
Dave

From: sacm [mailto:[email-masked]] On Behalf Of Schmidt, Charles M.
Sent: Thursday, May 19, 2016 3:40 PM
To: [email-masked]
Subject: [sacm] Proto-consensus: Application location

Hello all,

Between the discussions at IETF 95 and the virtual interim yesterday, there appears to be "in room" consensus on a few proposed updates and expansions to SWID M&A. As no IETF consensus is complete without mailing-list consensus, I'm sending out messages on each point of proto-consensus.

The topic of application location was discussed at the virtual interim on Tuesday, May 17. SWID tags indicate that a given software product (and a specific version thereof) is installed on an endpoint. SWID tags generally do not indicate where this product has been installed. Authoritative tags (i.e., tags published by a software vendor) never indicate this, and tags generated locally might or might not include this information. Multiple consumers of endpoint inventory information might find the location of an installed software product to be useful. The location of a software product could also be useful to resolve double-reporting issues: for example, if a SWID-PC delivers SWID tags gathered from the file system and also SWD tags generated by an package management tool, it is possible that a single product instance could be reported by a tag from both of these sources. A SWID-PV would need to determine whether this double reporting indicated a single installation reported twice, or two separate installations of the same software product. If the install location of the associated software product was reported, this would make it far easier for the SWID-PV to answer this question.

The only concern about including an application's installation location is that this might not be discoverable in most cases. In many cases it will be: package managers and inventory scanner tools will know this information, and 2015 SWID tags are required to be placed in a sub-directory of the product itself. However, 2009 SWID tags and other sources of inventory information can be divorced from the location of the reported product and re-linking them could be difficult. Despite this, the consensus in the room at the virtual interim was to include application location when reporting SWID tags, provided that a failure to resolve the location of an application produced something that denoted "LOCATION UNKNOWN" rather than an incorrect location.

Are there any concerns or questions about adding support for application location to the SWID tag reporting records, or is the online consensus support for this change?

Thanks,

Charles

---

From: "Waltermire, David A. (Fed)" <[email-masked]>
Date: Thu, 19 May 2016 20:46:15 +0000

Given the discussion about generalizing to support different record types, the location of the record could be used as a more general approach. The location of a SWID tag would be an example of this.

Regards,
Dave

From: sacm [mailto:[email-masked]] On Behalf Of Waltermire, David A. (Fed)
Sent: Thursday, May 19, 2016 4:42 PM
To: Schmidt, Charles M. <[email-masked]>; [email-masked]
Subject: Re: [sacm] Proto-consensus: Application location

Regards,
Dave

From: sacm [mailto:[email-masked]] On Behalf Of Schmidt, Charles M.
Sent: Thursday, May 19, 2016 3:40 PM
To: [email-masked]<mailto:[email-masked]>
Subject: [sacm] Proto-consensus: Application location

Hello all,

Thanks,

Charles

---

From: Adam Montville <[email-masked]>
Date: Thu, 19 May 2016 19:39:10 -0500

So something like, here’s where I found the tag, but I don’t know the install location…  Seems reasonable.

> On May 19, 2016, at 3:42 PM, Waltermire, David A. (Fed) <[email-masked]> wrote:
> 
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm

---

From: "Schmidt, Charles M." <[email-masked]>
Date: Fri, 20 May 2016 14:49:36 +0000

Seems reasonable, providing it is clear to the message recipient when it has a tag location rather than the app location.

Charles

> -----Original Message-----
> From: Adam Montville [mailto:[email-masked]]
> Sent: Thursday, May 19, 2016 7:39 PM
> To: Dave Waltermire <[email-masked]>
> Cc: Schmidt, Charles M. <[email-masked]>; [email-masked]
> 	On May 19, 2016, at 3:42 PM, Waltermire, David A. (Fed)
> <[email-masked] <mailto:[email-masked]> > wrote:
> 
> 	If unknown, could the location point to the location of the SWID tag
> instead? This would provide more information than something like
> "LOCATION UNKNOWN".
> 
> 	Regards,
> 	Dave
> 
> 
> 	To: [email-masked] <mailto:[email-masked]>
> 	Between the discussions at IETF 95 and the virtual interim yesterday,
> there appears to be "in room" consensus on a few proposed updates and
> expansions to SWID M&A. As no IETF consensus is complete without mailing-
> list consensus, I'm sending out messages on each point of proto-consensus.
> 
> 	The topic of application location was discussed at the virtual interim
> on Tuesday, May 17. SWID tags indicate that a given software product (and a
> specific version thereof) is installed on an endpoint. SWID tags generally do
> not indicate where this product has been installed. Authoritative tags (i.e.,
> tags published by a software vendor) never indicate this, and tags generated
> locally might or might not include this information. Multiple consumers of
> endpoint inventory information might find the location of an installed
> software product to be useful. The location of a software product could also
> be useful to resolve double-reporting issues: for example, if a SWID-PC
> delivers SWID tags gathered from the file system and also SWD tags
> SWID-PV would need to determine whether this double reporting indicated
> a single installation reported twice, or two separate installations of the same
> software product. If the install location of the associated software product
> was reported, this would make it far easier for the SWID-PV to answer this
> question.
> 
> 	The only concern about including an application's installation location
> is that this might not be discoverable in most cases. In many cases it will be:
> package managers and inventory scanner tools will know this information,
> and 2015 SWID tags are required to be placed in a sub-directory of the
> product itself. However, 2009 SWID tags and other sources of inventory
> information can be divorced from the location of the reported product and
> re-linking them could be difficult. Despite this, the consensus in the room at
> the virtual interim was to include application location when reporting SWID
> produced something that denoted "LOCATION UNKNOWN" rather than an
> incorrect location.
> 
> 	Are there any concerns or questions about adding support for
> application location to the SWID tag reporting records, or is the online
> consensus support for this change?
> 
> 	Thanks,
> 
> 	Charles
> 
> 	[email-masked] <mailto:[email-masked]>

---

From: "Waltermire, David A. (Fed)" <[email-masked]>
Date: Fri, 20 May 2016 16:15:59 +0000

Could this be represented by an empty final URL path?

For example:

file:/path/to/install/location/

file:/path/to/swidtag/file.xml

I am typing this out on a phone. As a result this syntax might not be 100% correct, but it should be close enough to illustrate.

Thoughts?

Thanks,
Dave
________________________________
On: 20 May 2016 10:49, "Schmidt, Charles M." <[email-masked]> wrote:
Seems reasonable, providing it is clear to the message recipient when it has a tag location rather than the app location.

Charles