Compatibility between TEA and SCID
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 30/100
- Issue type
- Feature
- Clarity
- Needs clarification
- Activity status
- Stale
- Domain
- api, backend-api-design
Research direction
Start by reading the SCID proposal in package-url/purl-spec#516 and the TEA Component Release definition. Examine how /component/{uuid}/releases currently resolves versions, then document the agreed compatibility changes for component lookup, name uniqueness, and release-list handling.
Written by the indexing model from the issue text.
Description
In package-url/purl-spec#516 @stevespringett proposed SCID as a new Package URL type for non-packaged software. For example:
pkg:scid/acme-industries.com/Acme/[email protected]
pkg:scid/acmerobotics.org/Acme/[email protected]
While a PURL doesn't necessarily need to resolve to a download location, this could be easily achieved if the company deploys a TEA service: the TEA Component Release object has all the data to properly find the download URLs of all the software distributions.
There are however a couple of aspects of the current draft that make it harded to use for a PURL type:
- There is no way to find a TEA Component by name, which means that UUIDs would need to be used. This is far from ideal for readability:
pkg:scid/acme-industries.com/Acme/[email protected] - Component names are not guaranteed to be unique. Unlike products, components name are not decided by the marketing department, so the uniqueness constraint could be introduced.
- Resolving a version number is a heavy operation, because
/component/{uuid}/releasesreturns the whole and not paginated list of releases.
- Dominant language
- Shell
- Stars
- 120
- Forks
- 24
- Avg merge
- 1d 6h
- Merged PRs (30d)
- 67
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from CycloneDX/transparency-exchange-api
-
Shorten and simplify clause 5 discoveryPossibly taken @oej claimed this 11 days ago. OpenTEI Discovery
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
CycloneDX/transparency-exchange-api#392 · 1 comment · 1 assignee ·
Maintainers usually reply within 1 day
-
Definition/explanation should come before usePossibly taken @oej claimed this 11 days ago. OpenTEI Discovery
Difficulty 1/5 Under an hour Newbie friendliness 90/100
CycloneDX/transparency-exchange-api#391 · 1 comment · 1 assignee ·
Maintainers usually reply within 1 day
-
Backlog
Difficulty 1/5 Under an hour Newbie friendliness 85/100
CycloneDX/transparency-exchange-api#343 · 2 comments · 1 reaction ·
Maintainers usually reply within 1 day
-
Fix normative reference to JSON schemaPossibly taken @gesa claimed this 2 days ago. OpenPrio 1 TEI Discovery
Difficulty 2/5 1-3 hours Newbie friendliness 58/100
CycloneDX/transparency-exchange-api#404 · 1 comment · 1 assignee ·
Maintainers usually reply within 1 day
-
Prio 1 TEI Discovery
Difficulty 2/5 1-3 hours Newbie friendliness 55/100
CycloneDX/transparency-exchange-api#390 · 1 comment ·
Maintainers usually reply within 1 day
All issues in CycloneDX/transparency-exchange-api
Similar issues
-
gdsa opencode: keep-alive cleanup trap fails with 'keepalive_pid: unbound variable'Possibly taken @darribas claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 65/100
-
icon request
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
-
Difficulty 1/5 Under an hour Newbie friendliness 78/100