CycloneDX / CycloneDX/transparency-exchange-api
Integration with PURL/SWID
- Dominant language
- Shell
- Stars
- 113
- Forks
- 22
- Avg merge
- 8d 12h
- Merged PRs (30d)
- 5
Description
We should add a note to TEA Component that recommends using the UUID of a TEA Component Release as `tagId` for a SWID.
See also [Arnout's comment on `package-url/purl-spec#305`](https://github.com/package-url/purl-spec/issues/305#issuecomment-2753860007):
> Sure - the challenge is not formatting the SWID, but properly 'managing' the tag id. If you randomly generate a new tag id every time you want to refer to the same artifact, that makes the tag id useless. If you want to always use the same tag id for the same artifact, then you either need **some 'tag registry'**, or distribute the tag inside the artifact, or get creative and base the tag on a hash of the other fields (but that sounds like a hack).
(emphasis mine)
Contributor guide
Assessment
This issue has not been assessed yet.