Re: [EXT] Artifact, or Element, or Package

To: Kay Williams <kayw@microsoft.com>, "sbom@omg.org" <sbom@omg.org>

Subject: Re: [EXT] Artifact, or Element, or Package

From: "Martin, Robert A." <ramartin@mitre.org>

Date: Mon, 21 Oct 2019 23:30:52 +0000

Accept-language: en-US

Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=mitre.org; dmarc=pass action=none header.from=mitre.org; dkim=pass header.d=mitre.org; arc=none

Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=lpxiazGq8EdvTsTUKRRLLutlamkhHb4h48IwCN23qgE=; b=jOM7NBKmzIEOVYksn75Pw1Zq+CGLxJD/2qukNuUptBVjcL6TuB0zd3BEaGXJM7IXeS94B5Ic47VyBOeqZQGhWNSwBo01IFx2ubd1R/4tOLvFYfnt0LZtN17EpADJo1KT/VsN9xqHqd5NvyJ2psOUw9Ks6gHi2LHX8ML18ggynsPqu/a7+oUS2XhEnabBTmJh4EbkaXhUGnxYKs8SJfL3kwb8Lgmw/Fr4g4jFyypWdUwgbYg+/XaO+tuCeFuSOAAV/jb/bo+7chW+qtC1a/BljV1D/CtBickxRXq/9mAlsFLSrBlpOmE1U21fbw3GWTQYw/XKA+SYbtvVU0tlNWkJPg==

Arc-seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=cvSub3S8QYF9BsigeN7Bu9H+iOMT1Z/Cy69nGNXGcI2I1F1mdZnV39YV69lZLlYGENzdsIPfJc+9q9HbHPQ6ifjyuM2r0giBi8lQM6QVTNao6TeckDqFRWESE7gmV36vevWF5tcVZ7nOjS5ORAnNj4VrJy9g8yWToPUgU6qXhXYE8kl+ON08mxW4/KXZhDoq5D6x+6n2ji2vSX3SRLgv2TCafJsDIn8Rbo3bDEt2S5e82jOUQufYFJQKDT8QU42FtVDhvYp0dINn23U1Fw47oXSd6D40k0IX5KaSLBVbh2fM1RFRqXusi3dMB/s+Q7eIT488o81I7z7EaSxDKy/d6A==

Authentication-results: spf=none (sender IP is ) smtp.mailfrom=ramartin@mitre.org;

Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mitre.org; h=from:to:subject:date:message-id:references:in-reply-to:content-type:mime-version; s=selector1; bh=lpxiazGq8EdvTsTUKRRLLutlamkhHb4h48IwCN23qgE=; b=rqp+3Ft4ymvLp71qF/ivGSkpkTl1Es+5fd2ZHRdMMLabmKMRYs2enEM6OH4wU5qQwd1HqYZRqdhl9fUYs2zGUS8SV+plH02NzVChgV/tx7w9qSI5EUSX0cGTaDN3jP4OgDzsuoEZ56T7vbK6/Dlr4AVMBbjU5AUP4IXl6yr0OGA=

In-reply-to: <1614_1571698801_5DAE3870_1614_826_3_MW2PR2101MB0971B0C4A97445AB0713CCD1C5690@MW2PR2101MB0971.namprd21.prod.outlook.com>

Msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2019-10-21T22:59:42.3563869Z;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=11;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Unknown

References: <1614_1571698801_5DAE3870_1614_826_3_MW2PR2101MB0971B0C4A97445AB0713CCD1C5690@MW2PR2101MB0971.namprd21.prod.outlook.com>

Thread-index: AdWIYPQjLCi+m3iHQ8mOUjxp6YXi5AABmYUM

Thread-topic: [EXT] Artifact, or Element, or Package

In OMG artifact is the favored term for this.

I support artifact.

Bob

Get Outlook for iOS

From: Kay Williams <kayw@microsoft.com>
Sent: Monday, October 21, 2019 6:59:43 PM
To: sbom@omg.org <sbom@omg.org>
Subject: [EXT] Artifact, or Element, or Package

Hi all,

Here is another nomenclature question for our group. I was talking with Kate Stewart (Linux Foundation, SPDX) this afternoon. We were discussing what to call the ‘target’ or ‘object’ of an SBOM. In other words, what is the ‘thing’ an SBOM describes. We think the ‘thing’ is broad, where it may span the following:

File diff
File
Commit, File Archive, Package, Container (all of which span multiple files)
File System, Cloud Service (all of which span multiple packages, containers, etc.)

Kate mentioned that in SPDX today the ‘thing’ is an ‘element’. (Not a ‘package’ – Philippe-Emmanuel, we may have been mapping to the wrong SPDX element).

I propose that for the SBOM we call the ‘thing’ an ‘artifact’. This has the following implications:

SPDX 3.0 would need to rename the ‘element’ field to ‘artifact’.
Philippe-Emmanuel would need to update the SBOM model to center around the term ‘artifact’.

Does this work? Thoughts?

Kay