CycloneDX / CycloneDX/transparency-exchange-api
Approach to Collections' Publisher API
- Dominant language
- Shell
- Stars
- 113
- Forks
- 22
- Avg merge
- 8d 12h
- Merged PRs (30d)
- 5
Description
Our current understanding of a Collection is a state of Artifacts (metadata documents) belonging to a Release.
A new version of Collection is automatically created once the state of Artifacts changes.
With this understanding, having implicit Publisher CRUD API for Collections seems problematic for the following reasons:
1. A Collection is implicitly created when a Release is created. Imagine, we just created a Release with no Artifacts - it would still have a Collection with Version 1, that contains empty set (that is by definition).
2. A Collection cannot be deleted if its Release still exists.
3. If any CRUD operation (except Read) happens on Release Artifacts, that automatically updates a Collection - in that sense, explicit Update call on collection is not very meaningful.
With all that, the only solution I see is to avoid explicit Publisher API on Collections, and instead treat them as Lamport timestamp for Release Artifacts (ref: https://en.wikipedia.org/wiki/Lamport_timestamp).
I believe we should discuss that / would be great if anybody has a better proposal.
Contributor guide
Assessment
This issue has not been assessed yet.