Some SWID Tag Resources

["Waltermire, David A. (Fed)" <david.waltermire@nist.gov>]

Here are some software identification (SWID) tag resources:

- Some general resources: https://scap.nist.gov/specifications/swid/

- NISTIR 8060 provides an overview of the capabilities and usage of 
SWID tags. It also provides requirements for SWID tags that enable 
various cybersecurity use cases.

http://nvlpubs.nist.gov/nistpubs/ir/2016/NIST.IR.8060.pdf

- There is the CoSWID draft nearing completion in the IETF which 
defines an alternate serialization to the SWID tag XML format to 
support devices that may require a smaller tag footprint.

https://datatracker.ietf.org/doc/draft-ietf-sacm-coswid/

- NIST has produced a Java-based command-line SWID tag validator based 
on NISTIR 8060 and ISO/IEC 19770-2:2015. This tool can also be invoked 
by API. I plan to open source the tool and the Decima library which 
provides the validation functionality.

https://scap.nist.gov/specifications/swid/ (under "SWID Tag Validation 
Tool")

Regards,
Dave