CycloneDX / CycloneDX/transparency-exchange-api

Approach to Collections' Publisher API

Open
#152 3 comments 0 reactions 0 assignees View on GitHub
Publish
Dominant language
Shell
Stars
113
Forks
22
Avg merge
8d 12h
Merged PRs (30d)
5

Description

Our current understanding of a Collection is a state of Artifacts (metadata documents) belonging to a Release.

A new version of Collection is automatically created once the state of Artifacts changes.

With this understanding, having implicit Publisher CRUD API for Collections seems problematic for the following reasons:

1. A Collection is implicitly created when a Release is created. Imagine, we just created a Release with no Artifacts - it would still have a Collection with Version 1, that contains empty set (that is by definition).
2. A Collection cannot be deleted if its Release still exists.
3. If any CRUD operation (except Read) happens on Release Artifacts, that automatically updates a Collection - in that sense, explicit Update call on collection is not very meaningful.

With all that, the only solution I see is to avoid explicit Publisher API on Collections, and instead treat them as Lamport timestamp for Release Artifacts (ref: https://en.wikipedia.org/wiki/Lamport_timestamp).

I believe we should discuss that / would be great if anybody has a better proposal.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.