CycloneDX / transparency-exchange-api

A standard API specification for exchanging supply chain artifacts and intelligence
https://tc54.org/
Apache License 2.0
56 stars 9 forks source link

Which DNS Record Type to use in Discovery? `URI` Record Type is not widely supported #64

Open madpah opened 6 days ago

madpah commented 6 days ago

https://github.com/CycloneDX/transparency-exchange-api/blob/main/discovery/readme.md#tei-resolution-using-dns currently states that DNS Records of type URI will be used to resolve the list of Transparency Exchange endpoints for the TEI in question.

However, the DNS record type URI does not seem to be supported widely - see AWS Route 53 screenshot where it is not available: Image

See https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/ResourceRecordTypes.html

Should we consider using another DNS record type - such as SRV or TXT that is more widely supported?

FYI @oej @stevespringett

oej commented 6 days ago

When talking with the IETF DNS people the URI record is the shit. Another alternative that gives the same level of failover and load balancing i SRV. Maybe we can point at that as a secondary option. You have that in the list above.

Considering RFC 7753 is from 2015 it is kind of scary it's not implemented, but when looking at it I see that it is classified as informational. That's propably the reason it's not implemented.

The HTTP people don't like SRV and have a new record type instead. I'll go hunting.

https://datatracker.ietf.org/doc/html/rfc7553

oej commented 6 days ago

The record is SVCB - the last one in your picture

https://datatracker.ietf.org/doc/rfc9460/?include_text=1

I need to lab a bit with it.

"Enabling SRV-like benefits (e.g., apex aliasing, as mentioned above) for HTTP, where SRV [SRV] has not been widely adopted."

Thank you for the feedback Paul. Good catch!

madpah commented 6 days ago

SVCB is new to me too! Will have to read up.

oej commented 6 days ago

As I have a history in SIP, SRV feels like home. ha ha. Let me know if you want a video chat to go through things. Find me on slack, signal or elsewhere.

oej commented 5 days ago

Contacted one of the authors of the DNS URI rfc. Got a very long story... Surprised they could agree on SVCB.