search

trustoverip / tswg-acdc-specification

Authentic Chained Data Containers (ACDC)
https://trustoverip.github.io/tswg-acdc-specification/
Other
11 stars 7 forks source link

Missing normative references? #95

Open edeykholt opened 7 months ago

edeykholt commented 7 months ago

Section 7. Normative references -- does not list any. Shouldn't KERI and CESR be listed?

m00sey commented 7 months ago

They aren't specifications yet so no, they can't be used as normative references (under certain SDO rules)

darrellodonnell commented 7 months ago

Are there really zero normative references (i.e. excluding KERI and CESR)?

pfeairheller commented 7 months ago

According to our ISO expert, normative references are only for existing ISO specs and since none of these are currently ISO specs we aren't listing them in Normative for now.

If we have different rules for when something becomes a normative spec in ToIP, we need to document that and document the process for how specs need to change when being passed to ISO.

darrellodonnell commented 7 months ago

ISO specifications often refer to non-ISO standards/specifications in a normative way. It is hard to point to examples as ISO is a pay-to-play SDO, but an example is the OpenChain specification (ISO/IEC 18974:2023), which has many normative references. This one isn't yet a formal ISO Standard - but it is close, as it is an ISO PAS.

https://github.com/OpenChain-Project/Security-Assurance-Specification/blob/main/Security-Assurance-Specification/ISO-18974/en/ISO-18974.md

talltree commented 7 months ago

I too was stunned to see the statement, "There are no normative references." While it may be an ISO convention to not include any non-ISO specs as normative, the vast majority of standards in the Internet community are coming from IETF or W3C, and if you try to publish a specification there without normative references, you won't get anywhere. So I would strongly recommend following the IETF and W3C precedent in the ToIP version of this specification and then revising it as required for ISO.

SmithSamuelM commented 7 months ago

In a meeting yesterday with Kevin we decided to move the IETF and W3C reference to the normative section for ToIPand then move them back for ISO. Although for foundational specifications like CESR the number of normative references is quite small.