Update OpenChain-Telco-SBOM-Guide_EN.md

[Jimmy-ahlberg]

Adding encryption and storage requirement.

[MasahiroDAIKOKU]

@vargenau
Thank you very much for creating and sharing draft 1.2. I apologize if I have posted this in the wrong place.

• Does this describe the process of conveying the SBOM between the provider and consumer, rather than requiring the SBOM to be encrypted within the provider's organization? Since it is a "SHALL" requirement, it is preferable to specify the conditions as much as possible.
• And, since we use the terms "consumer" and "consum" in Section 1 and 3.1 and elsewhere, it would be better to standardize the terminology. In 3.8.2 Rationale, I think “both the provider and the consumer of an SBOM” is clearer than “both the provider and the recipient of an SBOM.” What do you think?

[vargenau]

Cannot merge to official version 1.1.
Draft 1.2 created instead.

[vargenau]

Hello Masahiro-san, Thank you very much for your comments. I have updated the draft 1.2 with your suggestion in the second point. We will discuss the first point in our October meeting. Best regards, Marc-Etienne

…

-- Marc-Etienne Vargenau ***@***.******@***.***> Nokia, 12, rue Jean-Bart, 91300 Massy, FRANCE Mobile: +33 6 24 49 78 68<tel:+33624497868> Senior Specialist Open Source Planned absence: none De : Masahiro DAIKOKU ***@***.***> Date : lundi, 8 septembre 2025 à 09:04 À : OpenChain-Project/Telco-WG ***@***.***> Cc : Marc-Etienne Vargenau (Nokia) ***@***.***>, Mention ***@***.***> Objet : Re: [OpenChain-Project/Telco-WG] Update OpenChain-Telco-SBOM-Guide_EN.md (PR #214) [https://avatars.githubusercontent.com/u/121999752?s=20&v=4]MasahiroDAIKOKU left a comment (OpenChain-Project/Telco-WG#214)<#214 (comment)> @vargenau<https://github.com/vargenau> Thank you very much for creating and sharing draft 1.2. I apologize if I have posted this in the wrong place. * Does this describe the process of conveying the SBOM between the provider and consumer, rather than requiring the SBOM to be encrypted within the provider's organization? Since it is a "SHALL" requirement, it is preferable to specify the conditions as much as possible. * And, since we use the terms "consumer" and "consum" in Section 1 and 3.1 and elsewhere, it would be better to standardize the terminology. In 3.8.2 Rationale, I think “both the provider and the consumer of an SBOM” is clearer than “both the provider and the recipient of an SBOM.” What do you think? — Reply to this email directly, view it on GitHub<#214 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AAC4KKQGPFFV4TDVBBDBDGD3RUTAVAVCNFSM6AAAAACELIENJGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTENJSGYYTAMRTG4>. You are receiving this because you were mentioned.