CycloneDX / transparency-exchange-api

A standard API specification for exchanging supply chain artifacts and intelligence
https://tc54.org/
Apache License 2.0
61 stars 9 forks source link

Discovery: Clarify the INTENT of the TEI #89

Open oej opened 4 days ago

oej commented 4 days ago

We've had several discussions on the TEI syntax and the intent. This needs to be clarified.

oej commented 3 days ago

URNs are identifiers. URLs are locators. The point of having a URN is that it can be reached in many locations. An ISBN of a book is a unique identifier, a URL to it in Amazon is a locator.

By removing DNS failover and load balancing we are missing the point of an identifier and may move to URLs directly.

ppkarwasz commented 3 days ago

My PoV is slightly different:

I would really like for TEA clients to have an abstract TeiResolver interface from day 1. This interface will resolve a TEI identifier into an HTTPS endpoint (with all the parameters HTTP people like). I don't think this is a big burden on implementers.

oej commented 3 days ago

Ok, I'll buy that. Let's change to

I'll add some example code to my repo for that.

ppkarwasz commented 3 days ago

Ok, I'll buy that. Let's change to

  • The TEI syntax type move after the domain

We can move the type after the domain, if a DNS domain is always the right identifier for a software producer.

I don't think it is. For example the Apache Commons PMC could use these TEIs for their software:

As I mentioned elsewhere, we could have TEIs of the form urn:tei:vies:PL1234567890:<something> that are owned by whomever has that particular EU VAT number. Resolving such a TEI will require a lot of infrastructure, but the TEI itself is much more stable in time (I don't have to renew my VAT number :wink:).

Summarising: I think that your initial approach of putting <type> before <domain-name> was the correct one, although I am not sure that <domain-name> needs necessarily to be a DNS domain name. To bootstrap the system we need to use DNS domain names for now, but let us not exclude the possibility that a different identifier for each <type> will be used in the future.

ppkarwasz commented 3 days ago
  • We require TEI clients (not servers/services) to support HTTPS DNS failover and load balancing

Sure, that is something we could settle in stone. TEI resolvers should provide a prioritized list of HTTPS endpoints. It doesn't really matters how they do it, as long as they do it. The TEI resolver feeds the list to the TEA client, which will try the backups if a request fails.