TEA release staging and releasing
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 20/100
Research direction
Start by reviewing the TUF website, linked video, and community adoption examples cited in the issue. Before implementation, define the optional provider scope, staging and release workflow, delegated signing roles, and key-rotation expectations; the issue names no repository files or tests.
Written by the indexing model from the issue text.
Description
During a community meeting we discussed the technology that might be used for staging a release and then releasing it. In this context the use of TUF (The Update Framework) could be very valuable.
TUF allows us to do have delegated roles for signing artifacts. The power of TUF is in the way it establishes a trust root with signing delegations and allowing you to rotate keys if an artifact becomes compromised and should be retracted.
-
Must watch video on TUF and security artifact distribution. https://www.youtube.com/watch?v=lIYXVIPsk_U
-
There is a broad scope in adoption for TUF as a technology.
Using TUF should be an optional choice for providers probably.
- Dominant language
- Shell
- Stars
- 120
- Forks
- 24
- Avg merge
- 1d 6h
- Merged PRs (30d)
- 67
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from CycloneDX/transparency-exchange-api
-
Shorten and simplify clause 5 discoveryPossibly taken @oej claimed this 11 days ago. OpenTEI Discovery
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
CycloneDX/transparency-exchange-api#392 · 1 comment · 1 assignee ·
Maintainers usually reply within 1 day
-
Definition/explanation should come before usePossibly taken @oej claimed this 11 days ago. OpenTEI Discovery
Difficulty 1/5 Under an hour Newbie friendliness 90/100
CycloneDX/transparency-exchange-api#391 · 1 comment · 1 assignee ·
Maintainers usually reply within 1 day
-
Backlog
Difficulty 1/5 Under an hour Newbie friendliness 85/100
CycloneDX/transparency-exchange-api#343 · 2 comments · 1 reaction ·
Maintainers usually reply within 1 day
-
Fix normative reference to JSON schemaPossibly taken @gesa claimed this 2 days ago. OpenPrio 1 TEI Discovery
Difficulty 2/5 1-3 hours Newbie friendliness 58/100
CycloneDX/transparency-exchange-api#404 · 1 comment · 1 assignee ·
Maintainers usually reply within 1 day
-
Prio 1 TEI Discovery
Difficulty 2/5 1-3 hours Newbie friendliness 55/100
CycloneDX/transparency-exchange-api#390 · 1 comment ·
Maintainers usually reply within 1 day
All issues in CycloneDX/transparency-exchange-api
Similar issues
-
gdsa opencode: keep-alive cleanup trap fails with 'keepalive_pid: unbound variable'Possibly taken @darribas claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 65/100
-
icon request
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
-
Difficulty 1/5 Under an hour Newbie friendliness 78/100