[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Working to consensus - a change to the schedule for the 3T-SBOM efforts



Hi Everyone,

Thank you all for participating in the 3T-SBOM working group.

In just six short weeks we have covered much ground together. We have doubled the number of participants, we have learned how to create UML models and XMIs, we have created a web page, a Google drive folder and a GitHub repository. We have ongoing weekly meetings with healthy attendance. We are consolidating the work of a number of existing efforts. We have been working hard toward a draft specification submission on 11/11.

It is on this last point that this email will be the focus. After discussions with a number of you and also among the co-chairs, we have decided to delay the submission of the SBOM draft specification.

Previous target:

• Submission: November 11, 2019
• Architecture Board Review: December 9, 2019 at the
  OMG Long Beach meeting

New target:

• Submission: February 24, 2020 <<Bob, please verify>>
• Architecture Board Review: March 23, 2020 at the
  OMG Reston meeting

In evaluating this decision, we considered both the quality of the specification and the quality of the process. Here is what we found:

• The quality of the specification was good. For this we give a
  heartfelt thanks especially to Philippe-Emmanuel. Over the past 6
  weeks he has invested generous time and thoughtful attention to
  generating the model, and automating the documentation and
  illustrations.

• The quality of the process was not. Working group members had concerns
  about the model, and they felt those concerns were not heard. They
  were hearing from the co-chairs that there would be time to address
  concerns during the Request for Comment (RFC) period. They were
  feeling that because their concerns weren’t heard during the design
  phase it was likely they would not be heard during the RFC comment
  period. They let us know. We appreciate that they did and we are
  listening and taking action.

When we met in Nashville, we knew the November 11 date would be a stretch but at that point we all agreed we should try to meet it but we all would also be satisfied if we met the February date. So now we plan to refocus our effort to target the February submission date, with the following mileposts as a guide.

• Weekly meetings between now and December 10/11 – Discuss concerns, and
  also identify the user scenarios and technical requirements upon which
  we will design and gate our February submission.

• Face-to-Face meeting December 10/11 – work through the details of a
  model that satisfies our user scenarios and technical requirements.

• Holiday vacations

• January to February, complete the work to prepare for an RFC
  specification submission for the March meeting in Reston VA.

Thank you again for being part of this effort. Our work will be the basis of software transparency, quality, reliability and security for generations to come.

Sincerely,

the co-chairs,

Bob Martin, MITRE
Bill Curtis, CISQ
Kay Williams, Microsoft