Proposal: Collaborate with OpenEoX to Align Lifecycle Taxonomies and Enhance Interoperability

[santosomar]

Hello TG3 team,

I would like to propose a collaboration between Ecma TC54-TG3 and the OpenEoX standard technical committee to align efforts in standardizing product lifecycle information.

About OpenEoX

OpenEoX is an OASIS-led standard technical committee (TC) aimed at standardizing the exchange of End-of-Life (EOL), End-of-Security-Support (EoSSec), and other information across software and hardware industries. The project has garnered support from major organizations, including Cisco, Microsoft, Red Hat, Siemens, BSI, and CISA.

The OpenEoX framework defines a lightweight, machine-readable schema that could be integrated into existing standards such as SBOMs (e.g., CycloneDX, SPDX) and vulnerability advisories like CSAF and VEX. The goal is to provide consistent and transparent lifecycle information to enhance cybersecurity and supply chain risk management.

You can find the technical report detailing the OpenEoX framework here:

OpenEoX Standardization Framework Technical Report (PDF) --> "A Standardized Framework for Managing End of Life and other Product Lifecycle Information"

Potential Collaboration Between TG3 and OpenEoX

TG3's work on the Common Lifecycle Enumeration (CLE) aims to standardize the communication of lifecycle events. This aligns closely with OpenEoX's objectives.

Collaborating with OpenEoX could offer several benefits:

• Unified Taxonomy: Aligning lifecycle definitions and terminology to avoid fragmentation.

• Interoperability: Ensuring that CLE and OpenEoX schemas can work seamlessly with existing standards like SBOMs and CSAF.

• Broader Adoption: Leveraging the combined efforts to promote wider industry acceptance and implementation.

I suggest initiating a dialogue between TG3 and the OpenEoX Technical Committee to explore areas of collaboration. By working together, we can enhance the clarity and consistency of product lifecycle information, ultimately improving cybersecurity and supply chain transparency.

[noqcks]

Hi @santosomar,

Thanks for reaching out and for the clear overview of OpenEoX. The Common Lifecycle Enumeration (CLE) work shares the same vision of clear, machine‑readable lifecycle data, so we're happy to collaborate!

We’d love to open a direct channel, whichever you think is best:

• we can arrange a call with TG3's co‑chairs, or
• we can sit in on your next OpenEoX meeting, or
• you’re welcome to join the next TG3 CLE session

I just added you on LinkedIn if we need to coordinate scheduling.

EDIT: Forgot to mention where you can find the most up-to-date information on the CLE. We're working in this PR right now, and of course all meeting notes are in this repo.

[santosomar]

I love this! Yes to all 3! Thank you so much and looking forward to collaborating!