search

CycloneDX / transparency-exchange-api

A standard API specification for exchanging supply chain artifacts and intelligence
https://tc54.org/
Apache License 2.0
59 stars 9 forks source link

TEA publishing in various eco systems #73

Open oej opened 4 days ago

oej commented 4 days ago

Should we open issues to discuss how publishing to TEA would look for various ecosystems?

As I stated before, a TEA publisher REST API is probably not required in the first TEA versions. For the Maven ecosystem I would expect TEA publishing to work as follows:

  1. User publish artifacts with a classifier of cyclonedx or sbom, as they do now.
  2. The Maven repository manager will expose those artifacts through some kind of additional TEA plugin. We probably should ask the main repository managers (Sonatype Nexus and JFrog) how they feel about exporting the current repository metadata through TEA.

Do we have any contacts with JFrog?

Originally posted by @ppkarwasz in #55