CycloneDX / CycloneDX/transparency-exchange-api

Integration with PURL/SWID

Open
#107 0 comments 0 reactions 0 assignees View on GitHub
Prio 2 TEA Component
Dominant language
Shell
Stars
113
Forks
22
Avg merge
8d 12h
Merged PRs (30d)
5

Description

We should add a note to TEA Component that recommends using the UUID of a TEA Component Release as `tagId` for a SWID.

See also [Arnout's comment on `package-url/purl-spec#305`](https://github.com/package-url/purl-spec/issues/305#issuecomment-2753860007):

> Sure - the challenge is not formatting the SWID, but properly 'managing' the tag id. If you randomly generate a new tag id every time you want to refer to the same artifact, that makes the tag id useless. If you want to always use the same tag id for the same artifact, then you either need **some 'tag registry'**, or distribute the tag inside the artifact, or get creative and base the tag on a hash of the other fields (but that sounds like a hack).

(emphasis mine)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.