[Question] Usage of vendor_Id (see also #267)

["Schmidt, Thomas" <thomas.schmidt@bsi.bund.de>]

Dear colleagues,
is anyone aware of that the field /document/publisher/vendor_id (https://github.com/oasis-tcs/csaf/blob/master/csaf_2.0/prose/csaf-v2-editor-draft.md#32185-document-property---publisher---vendor-id; previously: VendorID in http://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/cs01/csaf-cvrf-v1.2-cs01.html#_Toc493508869) is used?

Does anyone know whether FIRST does now issue OIDs? And if so, are these OIDs limited to companies or are communities or projects (as OpenSSL or Zephyr) able to retrieve those?

If no one uses them, I would suggest to remove the field from the standard.

Instead we could add a field where the publisher could put a URL in. That would help with the potential namespace problem as the document tracking identifiers (/document/tracking/id) are only unique for the issuing organization.

Thoughts?

Best regards,
Thomas

Attachment: smime.p7s
Description: S/MIME cryptographic signature