prov-meta-csdpr01: T4. Placeholder content in a normative table (section 5.3)

[sthagen]

T4. Placeholder content in a normative table (section 5.3)

The sub-provenance field's description reads "Add key/link?", which appears to be an unresolved editorial note rather than a definition.
Its type (Provenance, cardinality 1) also implies infinite recursion as written.

Suggested resolution:

define the field's semantics and cardinality, or remove it from CSD01.

---

Part of CSDPR01 feedback from Yoshi Aoki (yoshi@1o1.co.jp) received 2026-06-11 documnented in full in issue # 167

[LisaBobbitt]

Provenance is suppose to be recursive as far as I understand as it is the history of the changes to the data set. Stefan, what do you think?

[sthagen]

@LisaBobbitt

Provenance is suppose to be recursive as far as I understand as it is the history of the changes to the data set. Stefan, what do you think?

Yes, statements of provenance should compose if needed. This recursion we received (wrongly spelled out in JSON terms) from the original DTA contribution.

We will have to bound the recursion depth (and width) though for practical security and interoperability purposes. For the latter we absolutely need taxonomies of typical data sets describing provenance (in a pre-DPS world).

We provide such guidance (on security advisory "sizes") for example in the CSAF specification.