ppkarwasz commented on issue #614: URL: https://github.com/apache/tooling-trusted-releases/issues/614#issuecomment-3921455104
I agree that UUIDs are far from being transparent. I based the proposal above, based on the current [TEA specification](https://github.com/CycloneDX/transparency-exchange-api/blob/main/spec/openapi.yaml), which does not allow to lookup a component by name. That is probably something that needs to be fixed, if we want to use a TEA server to define a PURL type. In the example I gave: ``` pkg:tea/apache.org/[email protected] ``` `0109bbc5-ae05-4033-b6f4-046009d7785b` is the UUID of a Component. The Component Release can be retrieved by version number by calling `/component/0109bbc5-ae05-4033-b6f4-046009d7785b/releases` and filtering the results. This is hardly a practical method, so this part of TEA would also need to be improved. According to the PURL spec, it would be also possible to create a PURL like: ``` pkg:tea/apache.org/0109bbc5-ae05-4033-b6f4-046009d7785b@605d0ecb-1057-40e4-9abf-c400b10f0345 ``` but this looks even worse. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
