Update References chapter

[bact]

• Add Non-normative References section
• Using text from Bob's Word doc 2024-07-22 and existing reference formatting from normative-reference.md:
• Links update
  • "The Minimum Elements For a Software Bill of Materials"
    • https://www.ntia.doc.gov/files/ntia/publications/sbom_minimum_elements_report.pdf not found
    • update to https://www.ntia.gov/report/2021/minimum-elements-software-bill-materials-sbom
  • NIST IR 7695
    • https://csrc.nist.gov/publications/detail/nistir/7695/final -> https://csrc.nist.gov/pubs/ir/7695/final

Notes

• https://spdx.org/rdf/ontology/spdx-3-0-1 does not exist
• List formatting consistency
  • Normative References uses regular paragraphs, one reference per one paragraph - no numbered
  • Non-normative References uses numbered list
    • Because these numbers will be used in "Annex F: History, Motivation and Rational" (in the text as [6], [2, 3], etc)
• Numbering 10, 11, 12 in this PR and in the Word doc is not sync. As in the original Word doc 10. is missing/skipped.
  • Need to resync the numbers with the final Annex F.
• For IETF RFC links, wait for a decision from What is a standard URL to reference IETF RFC? #1012

[bact]

Missing References

These are referred to in model descriptions but not yet documented in the References section.

In AI Profile:

• SafetyRiskAssessmentType:
  • https://ec.europa.eu/docsroom/documents/17107 - EU general risk assessment methodology

In Build Profile:

• https://slsa.dev/provenance/v0.2 - SLSA provenance v0.2

In Core Profile:

• MediaType:
  • https://www.rfc-editor.org/info/rfc2046 - RFC 2046 MIME Part Two: Media Types
  • https://www.iana.org/assignments/media-types/media-types.xhtml - IANA Protocol Registries - Media Types
• ExternalIdentifierType:
  • https://csrc.nist.gov/glossary/term/cve_id - for cve
  • https://www.rfc-editor.org/info/rfc3696- for email
  • https://www.rfc-editor.org/info/rfc9393 - for swid
  • https://www.iana.org/assignments/uri-schemes/uri-schemes.xhtml - for urlScheme
• ExternalRefType
  • https://cwe.mitre.org/data/ - CWE List
  • https://cwe.mitre.org/ - CWE specification
  • https://csrc.nist.gov/glossary/term/common_weakness_enumeration - Common Weakness Enumeration
  • https://csrc.nist.gov/pubs/sp/800/218/final - NIST SP 800-218 Secure Software Development Framework (SSDF) Version 1.1
  • https://csrc.nist.gov/pubs/sp/800/161/r1/final - NIST SP 800-161 Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations
  • https://www.cisa.gov/resources-tools/resources/secure-software-development-attestation-form - CISA Secure Software Development Attestation Form
  • https://ntia.gov/files/ntia/publications/vex_one-page_summary.pdf - NTIA VEX one-page summary
  • https://www.iso.org/standard/72311.html - ISO 29147:2018
  • https://en.wikipedia.org/wiki/Penetration_test - penetration test
  • https://en.wikipedia.org/wiki/Threat_model - security threat model
• HashAlgorithm
  • https://www.rfc-editor.org/info/rfc1186 - RFC 1186
  • https://www.rfc-editor.org/info/rfc1319 - RFC 1319
  • https://www.rfc-editor.org/info/rfc3874 - RFC 3874
  • https://www.rfc-editor.org/info/rfc7693 - RFC 7693
  • https://csrc.nist.gov/pubs/fips/202/final - FIPS 202
  • https://people.csail.mit.edu/rivest/pubs/RABCx08.pdf - MD6 hash function
  • https://github.com/BLAKE3-team/BLAKE3-specs/blob/master/blake3.pdf - BLAKE3
  • https://pq-crystals.org/dilithium/ - Dilithium
  • https://pq-crystals.org/kyber/ - Kyber
  • https://falcon-sign.info/falcon.pdf - FALCON

In Dataset Profile:

• ConfidentialityLevelType:
  • https://en.wikipedia.org/wiki/Traffic_Light_Protocol - Traffic Light Protocol

In ExpandedLicensing Profile:

• https://github.com/spdx/license-list-XML/blob/main/DOCS/xml-fields.md - XML template fields
• https://github.com/spdx/license-list-XML/blob/main/schema/ListedLicense.xsd -SPDX license-list-XML GitHub repository

In Security Profile:

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog - CISA Known Exploited Vulnerabilities Catalog
• https://www.cisa.gov/stakeholder-specific-vulnerability-categorization-ssvc - Stakeholder-Specific Vulnerability Categorization (SSVC)
• https://www.first.org/cvss/
• https://www.first.org/cvss/v2/guide - A Complete Guide to the Common Vulnerability Scoring System Version 2.0
• https://www.first.org/cvss/v3.0/specification-document
• https://www.first.org/cvss/v3.1/specification-document
• https://www.first.org/cvss/v4.0/specification-document - Common Vulnerability Scoring System version 4.0: Specification Document
• https://www.first.org/cvss/cvss-v3.0.json
• https://www.first.org/cvss/cvss-v3.1.json
• https://www.first.org/cvss/cvss-v4.0.json
• https://www.first.org/epss/model - The EPSS Model
• https://www.first.org/epss/data_stats - EPSS Data

In Software Profile:

• https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst - Package URL core
• https://www.cisa.gov/sites/default/files/2023-04/sbom-types-document-508c.pdf - Types of Software Bill of Material (SBOM) Documents

[bact]

Should we specify the version for "Common Platform Enumeration (CPE) – Specification" ?

• There's no version specified for "Common Platform Enumeration (CPE) – Specification" in the Normative References section.
  • Its URL in the our document is https://cpe.mitre.org/files/cpe-specification_2.2.pdf
• At the top of our Normative References section, we said
  "For undated references, the latest edition of the referenced document (including any amendments) applies."
  • The latest and last version (before it was archived) of CPE is 2.3, see: https://cpe.mitre.org/specification/
  • Does this means, for this ref, CPE 2.3 will apply?
• Next to it, we we also have a ref to "NIST IR 7695 Common Platform Enumeration: Naming Specification Version 2.3" which is part of CPE 2.3 stacks.
• In our current v3 model, there are at least two citations to CPE, in ExternalIdentifierType:
  • cpe22 cites https://cpe.mitre.org/files/cpe-specification_2.2.pdf
  • cpe23 cites NIST IR 7695

Should we change the line:
"Common Platform Enumeration (CPE) – Specification, The MITRE Corporation"
to:
"Common Platform Enumeration (CPE) – Specification 2.2, The MITRE Corporation" ?

--

spdx/spdx-3-model#806 will clarify this on the model side.

[bobmartin3000]

LGTM

[kestewart]

Looks good.

[goneall]

LGTM