CycloneDX / CycloneDX/transparency-exchange-api

Support identifier on the TEA Artifact level

Open
#242 2 comments 2 reactions 0 assignees View on GitHub
enhancement
Dominant language
Shell
Stars
113
Forks
22
Avg merge
8d 12h
Merged PRs (30d)
5

Description

Currently we have identifiers on the following levels:
- TEA Product
- TEA Product Release
- TEA Component
- TEA Component Release
- TEA Distribution
- CLE Event

It would make sense to also add identifiers on the TEA Artifact level with addition of BOM specific identifier types, such as `serialNumber` for CycloneDX or `documentNamespace` / `spdxId` for SPDX.

To implement this, we would need to:
1. Extend TEA Artifact type with list of identifiers
2. Provide API to perform direct search for TEA Artifacts based on identifier

*Note:* while BOM standards may assume that document identifiers are globally unique, we may not have such assumptions from the perspective of TEA (see #217 ) - therefore, we always assume that everything is essentially namespaced by a particular TEA Server, where uniqueness can actually be guaranteed.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.