Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add BOM Meta Endpoint #2

Open
stevespringett opened this issue Apr 8, 2022 · 7 comments · May be fixed by #10
Open

Add BOM Meta Endpoint #2

stevespringett opened this issue Apr 8, 2022 · 7 comments · May be fixed by #10
Labels
enhancement New feature or request Pre-TEA: BOM Exchange

Comments

@stevespringett
Copy link
Member

The idea behind a BOM Meta endpoint is to provide format, hash, and external signature information.

The BOM Meta retrieval would work similar to the existing BOM retrieval, but would return metadata rather than the BOM itself.

bom-meta-url = system-url "/" bom-identifier
bom-identifier    = segment
                        ; an identifier that uniquely identifies a BOM
                        ; NOTE: MUST be appropriately URI encoded
                        ; segment as defined in RFC3986

As an example, here's a snippet response for what I'm thinking about being returned:

{
  "spec": {
    "format": "CycloneDX",
    "version": "1.4",
    "mime-type": "application/vnd.cyclonedx+json",
  },
  "published": "2022-03-07T15:50+00Z",
  "checksum": [
    { "alg": "SHA-256", "value": "CF80CD8..." },
    { "alg": "SHA-512", "value": "CF80CD8..." },
    { "alg": "SHA3-256", "value": "CF80CD8..." },
    { "alg": "SHA3-512", "value": "CF80CD8..." },
    { "alg": "BLAKE3", "value": "CF80CD8..." }
  ],
  "signature": [
  
  ]
}

I think alg should be an enum with only those supported algorithms.

As for signatures, it would be ideal if we could support external signature files, signature services (e.g sigstore), and external inline.
@stevespringett stevespringett added the enhancement New feature or request label Apr 8, 2022
@stevespringett
Copy link
Member Author

If this is acceptable, I'll create a PR that adds this to the spec and we can figure out the details.

@coderpatros
Copy link
Member

Should we include group, name and version of the software the BOM is for as well?

@stevespringett
Copy link
Member Author

stevespringett commented May 12, 2022 •
edited
Loading

Should we include group, name and version of the software the BOM is for as well?

I don't think so. CycloneDX has these things. SPDX does not. IMO, I think we keep it strictly metadata about the BOM, not its contents.

@stevespringett stevespringett linked a pull request Jun 7, 2022 that will close this issue
Open
@oej
Copy link
Collaborator

oej commented Aug 20, 2024

This is much like HEAD in HTTP. I like this idea.

@oej oej mentioned this issue Aug 20, 2024
Open
@0x73746F66
Copy link

This is much like HEAD in HTTP. I like this idea.

HEAD has no body returned. rfc9110 9.3.2
TL;DR a HEAD method is intended to be the same headers returned, with no body, for the corresponding GET.
This offers a lean way to assists in an assessment for whether or not a full GET is required to be called next.

@madpah
Copy link
Collaborator

madpah commented Nov 11, 2024

I understand the concept in this ticket, but it is not clear in this ticket why such an endpoint is required and in what scenarios this provides value.

@stevespringett, @oej - is there anything that can be added as a reference or explanation (for myself and the wider community)?

@oej
Copy link
Collaborator

oej commented Nov 11, 2024

Note that this ticket is pre-TEA, it does not refer to current work.

@oej oej mentioned this issue Nov 13, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement New feature or request Pre-TEA: BOM Exchange
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Added metadata endpoint CycloneDX/transparency-exchange-api
5 participants
@oej @coderpatros @stevespringett @madpah @0x73746F66