CycloneDX / CycloneDX/transparency-exchange-api

Application-level TEA redirects

Open
#197 0 comments 0 reactions 0 assignees View on GitHub
Backlog enhancement
Dominant language
Shell
Stars
113
Forks
22
Avg merge
8d 12h
Merged PRs (30d)
5

Description

In the meeting we discussed using the PURL `repository_url` qualifier to locate a TEA server. The downside: this assumes each package repository runs a TEA service for millions of packages, which is unlikely.

As an alternative we could allow allow TEA endpoints (especially `productReleases`) to include **redirects** to external TEA servers, for example by allowing special **link objects** in the response alongside normal `productRelease` objects.

This would let package repositories support TEA at minimal cost by simply redirecting requests to the TEA servers operated by individual package owners.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.