Ownership and licensing statements in YANG
draft-ietf-opsawg-ol-05

Network Working Group                                            E. Lear
Internet-Draft                                             Cisco Systems
Updates: 8520 (if approved)                                   C. Bormann
Intended status: Standards Track                  Universität Bremen TZI
Expires: 20 October 2024                                   18 April 2024

               Ownership and licensing statements in YANG
                        draft-ietf-opsawg-ol-05

Abstract

   This memo provides for an extension to RFC 8520 that allows MUD file
   authors to specify ownership and licensing of MUD files themselves.
   This memo updates RFC 8520.  However, it can also be used for
   purposes outside of MUD, and the grouping is structured as such.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at https://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on 20 October 2024.

Copyright Notice

   Copyright (c) 2024 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents (https://trustee.ietf.org/
   license-info) in effect on the date of publication of this document.
   Please review these documents carefully, as they describe your rights
   and restrictions with respect to this document.  Code Components
   extracted from this document must include Revised BSD License text as
   described in Section 4.e of the Trust Legal Provisions and are
   provided without warranty as described in the Revised BSD License.

Lear & Bormann           Expires 20 October 2024                [Page 1]
Internet-Draft       Owner and Licensing Statements           April 2024

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  The owner-license extension and model . . . . . . . . . . . .   3
   3.  The YANG schema for ownership and licensing . . . . . . . . .   3
   4.  Extension for MUD . . . . . . . . . . . . . . . . . . . . . .   5
   5.  Example . . . . . . . . . . . . . . . . . . . . . . . . . . .   5
   6.  Security Considerations . . . . . . . . . . . . . . . . . . .   6
   7.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   6
     7.1.  MUD Extension . . . . . . . . . . . . . . . . . . . . . .   6
   8.  Normative References  . . . . . . . . . . . . . . . . . . . .   7
   Appendix A.  Changes from Earlier Versions  . . . . . . . . . . .   7
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .   8

1.  Introduction

   [RFC8520] Manufacturer Usage Descriptions (MUD) can be used to
   describe devices and their requirements to the network
   infrastructure.  The original version of the specification does not
   provide for a means to specify ownership and licensing of the MUD
   file itself.  This can hinder those wishing to use, modify, or adapt
   MUD files for the purpose of offering them, when the manufacturer is
   not involved.

   *  *Issue*: Should this be an owner or an originator?

   To avoid any confusion, we define an extension that allows for
   specifying of owners and licensing terms for MUD files.

   Those generating MUD files SHOULD use this extension, and thus this
   extension updates RFC 8520.

   There are two ways to specify a license: a URL pointing to the
   license itself or an SPDX tag [SPDX].  If an SPDX tag is supplied
   consumers MUST interpret that tag through its meaning as specified by
   [SPDX].

   *  *Issue*: Should we simply say that a URI contains a colon and SPDX
      license identifier doesn't?

   This grouping may be used for other YANG models that reside as static
   objects.

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
   "OPTIONAL" in this document are to be interpreted as described in
   BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all
   capitals, as shown here.

Lear & Bormann           Expires 20 October 2024                [Page 2]
Internet-Draft       Owner and Licensing Statements           April 2024

2.  The owner-license extension and model

   Because the model is primarily motivated by MUD, and based on the way
   that YANG trees are formed, the model appears as an augmentation for
   MUD.

   module: ietf-ol

     augment /mud:mud:
       +--rw ol
          +--rw owners*               string
          +--rw (license-type)?
             +--:(spdx-lt)
             |  +--rw spdx-tag?       string
             +--:(url)
                +--rw license-info?   inet:uri

   *  *Issue*: Should different owners possibly have their own license
      types?  (Logical and, derived works.)

   *  *Issue*: Should a single owner possibly have multiple license
      types?  (Logical or, multi-licensing.)

3.  The YANG schema for ownership and licensing

   The following grouping and augmentation are proposed.

   <CODE BEGINS> file "ietf-ol@2021-05-21.yang"
   module ietf-ol {
     yang-version 1.1;
     namespace "urn:ietf:params:xml:ns:yang:ietf-ol";
     prefix ol;

     import ietf-inet-types {
       prefix inet;
     }

     import ietf-mud {
       prefix mud;
     }

     organization
       "IETF OPSAWG (Ops Area) Working Group";
     contact
       "WG
        Web: http://tools.ietf.org/wg/opsawg/
        WG List: opsawg@ietf.org

Lear & Bormann           Expires 20 October 2024                [Page 3]
Internet-Draft       Owner and Licensing Statements           April 2024

        Author: Eliot Lear lear@cisco.com
        Author: Carsten Bormann <cabo@tzi.org>";
     description
       "This YANG module to indicate ownership and licensing.

        Copyright (c) 2021 IETF Trust and the persons identified as
        authors of the code.  All rights reserved.

        Redistribution and use in source and binary forms, with or
        without modification, is permitted pursuant to, and subject to
        the license terms contained in, the Simplified BSD License set
        forth in Section 4.c of the IETF Trust's Legal Provisions
        Relating to IETF Documents
        (https://trustee.ietf.org/license-info).

        This version of this YANG module is part of RFC XXXX
        (https://www.rfc-editor.org/info/rfcXXXX);
        see the RFC itself for full legal notices.

        The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', 'SHALL
        NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', 'NOT RECOMMENDED',
        'MAY', and 'OPTIONAL' in this document are to be interpreted as
        described in BCP 14 (RFC 2119) (RFC 8174) when, and only when,
        they appear in all capitals, as shown here.  ";

     revision 2021-05-21 {
       description
         "Initial proposed standard.";
       reference
         "RFC XXXX: Extension for ownership and licensing";
     }

     grouping ol-extension {
       description
         "OL extension grouping";
       container ol {
         description
           "container relating to ownership and licensing.";
         leaf-list owners {
         type string;
           description
             "A list of owners, may be in the form of a copyright
              Example: Copyright (c) Jane Smith.  All rights Reserved.";
           }
         choice license-type {
           description "Either choose a standard license type or point
                        to one of your own.";
           case spdx-lt {

Lear & Bormann           Expires 20 October 2024                [Page 4]
Internet-Draft       Owner and Licensing Statements           April 2024

             leaf spdx-tag {
               type string;
               description "SPDX License Identifier, as indicated at
                            https://spdx.org/licenses/";
             }
           }
           case url {
             leaf license-info {
               type inet:uri;
               description "A URL pointing to licensing information.";
             }
           }
         }
       }
     }

     augment "/mud:mud" {
       description
         "Add extension for Ownership and licensing.";
       uses ol-extension;
     }
   }
   <CODE ENDS>

4.  Extension for MUD

   MUD files using this extension MUST include "ol" in the extensions
   array, as specified by [RFC8520].

5.  Example

   In this example, the Frobmaster company is using the 0BSD SPDX tag to
   indicate a relatively open license.  The "ol" extension and container
   are present.  There is a single owner listed.

Lear & Bormann           Expires 20 October 2024                [Page 5]
Internet-Draft       Owner and Licensing Statements           April 2024

   {
     "ietf-mud:mud": {
       "mud-version": 1,
       "extensions": [
         "ol"
       ],
       "ol": {
         "owners": [
           "Copyright (c) FrobMaster 2021. All Rights Reserved"
         ],
         "spdx-tag": "0BSD"
       },
       "mud-url": "https://frobs.example.com/mud/Frob.json",
       "mud-signature": "https://frobs.example.com/mud/Frob.p7s",
       "last-update": "2021-05-24T11:26:04+00:00",
       "cache-validity": 48,
       "is-supported": true,
       "systeminfo": "This device helps produce frobs",
       "mfg-name": "FrobMaster",
       "documentation": "https://frobs.example.com/doc",
       "model-name": "Frobinator"
     }
   }

   *  *Task*: need Makefile for validating this against MUD.  (Probably
      put this into a separate file, too.)

   *  *Issue*: Should we give an example for usage outside yang?

6.  Security Considerations

   The security considerations of Section 16 of [RFC8520] with respect
   to obtaining validation for information claimed in a MUD file do
   apply.  While the information described in this specification is not
   intended to directly influence the behavior of protective
   infrastructure, it may be used by an aggregator as input for deciding
   the legal basis that enables providing aggregated information;
   depending on the juridical environment, false information in the MUD
   file may thus expose the aggregator to additional legal risk.

7.  IANA Considerations

7.1.  MUD Extension

   The IANA is requested to add "ol" to the MUD extensions registry of
   [IANA.mud] as follows:

   Extension Name:

Lear & Bormann           Expires 20 October 2024                [Page 6]
Internet-Draft       Owner and Licensing Statements           April 2024

      ol

   Standard reference:
      This document

8.  Normative References

   [IANA.mud] IANA, "Manufacturer Usage Description (MUD)",
              <http://www.iana.org/assignments/mud>.

   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119,
              DOI 10.17487/RFC2119, March 1997,
              <https://www.rfc-editor.org/rfc/rfc2119>.

   [RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
              2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
              May 2017, <https://www.rfc-editor.org/rfc/rfc8174>.

   [RFC8520]  Lear, E., Droms, R., and D. Romascanu, "Manufacturer Usage
              Description Specification", RFC 8520,
              DOI 10.17487/RFC8520, March 2019,
              <https://www.rfc-editor.org/rfc/rfc8520>.

   [SPDX]     The Linux Foundation, "The Software Package Data Exchange®
              (SPDX®) Specification Version 2.3", 2022,
              <https://spdx.github.io/spdx-spec/v2.3/>.

Appendix A.  Changes from Earlier Versions

   Draft -02:

   *  Small updates to the example

   Draft -01:

   *  Format IANA considerations

   *  Discuss security considerations

   Draft -00:

   *  Resubmit unchanged

   Individual Draft -01:

   *  Add some issues

Lear & Bormann           Expires 20 October 2024                [Page 7]
Internet-Draft       Owner and Licensing Statements           April 2024

   *  correct spacing

   Individual Draft -00:

   *  Initial revision

Authors' Addresses

   Eliot Lear
   Cisco Systems
   Richtistrasse 7
   CH-8304 Wallisellen
   Switzerland
   Phone: +41 44 878 9200
   Email: lear@cisco.com

   Carsten Bormann
   Universität Bremen TZI
   Postfach 330440
   D-28359 Bremen
   Germany
   Email: cabo@tzi.org

Lear & Bormann           Expires 20 October 2024                [Page 8]