Skip to content

Conversation

@ppkarwasz
Copy link
Contributor

This PR modifies the schema of the domain objects according to the structure discussed in the Koala Workshop

This PR modifies the schema of the domain objects according to the structure discussed in the Koala Workshop

Signed-off-by: Piotr P. Karwasz <piotr@github.copernik.eu>
@ppkarwasz ppkarwasz requested review from madpah and oej as code owners April 17, 2025 08:25
…feat/domain-objects

Signed-off-by: Piotr P. Karwasz <piotr@github.copernik.eu>
Signed-off-by: Piotr P. Karwasz <piotr@github.copernik.eu>
@ppkarwasz ppkarwasz force-pushed the feat/domain-objects branch from 0fde141 to 1acf408 Compare April 17, 2025 13:17
@ppkarwasz
Copy link
Contributor Author

This PR is based on #117.

ppkarwasz added 5 commits May 2, 2025 12:23
Signed-off-by: Piotr P. Karwasz <piotr@github.copernik.eu>
Signed-off-by: Piotr P. Karwasz <piotr@github.copernik.eu>
Signed-off-by: Piotr P. Karwasz <piotr@github.copernik.eu>
Signed-off-by: Piotr P. Karwasz <piotr@github.copernik.eu>
@ppkarwasz
Copy link
Contributor Author

Since there are lot of changes in this PR, here is a breakdown on how this integrates with the API Flow:

  1. If a client knows the UUID of a TEA product, it can call /product/{uuid} to obtain such an object:

    product:
    type: object
    description: A TEA product
    properties:
    uuid:
    "$ref": "#/components/schemas/uuid"
    name:
    type: string
    description: Product name
    identifiers:
    type: array
    description: List of identifiers for the product
    items:
    "$ref": "#/components/schemas/identifier"
    components:
    type: array
    description: List of TEA components for the product
    items:
    "$ref": "#/components/schemas/uuid"

  2. If the client does not know the UUID of a TEA product, it can call /products with some query parameters and get a paginated list of the same objects as above.

  3. Once the client has a list of UUIDs of TEA components, it probably should call /component/{uuid} to identify what those UUIDs correspond to. We probably can optimize the workflow by including the object below in the answer returned by /product/{uuid}:

    component:
    type: object
    description: A TEA component
    properties:
    uuid:
    "$ref": "#/components/schemas/uuid"
    name:
    type: string
    description: Component name
    identifiers:
    type: array
    description: List of identifiers for the component
    items:
    "$ref": "#/components/schemas/identifier"

  4. Once the client determines which component it is interested in it can call /component/{uuid}/versions with some query parameters (currently none) to list of the available versions of the component:

    component-version:
    type: object
    description: A specific version of a TEA component
    properties:
    collection_uuid:
    "$ref": "#/components/schemas/uuid"
    version:
    type: string
    description: Version number of TEA component
    identifiers:
    type: array
    description: List of identifiers for this component version
    items:
    "$ref": "#/components/schemas/identifier"
    release_date:
    "$ref": "#/components/schemas/date-time"
    description: Release date
    pre_release:
    type: boolean
    description: Marks if the version is a pre-release version
    classifier:
    type: object
    description: Optional classifier to distinguish between artifacts

  5. The last call is a call to /collection/{uuid}, which returns the latest version of the collection with a list of artifacts. Each artifact contains a list of artifact formats:

    collection:
    type: object
    description: A collection of security-related documents
    properties:
    uuid:
    "$ref": "#/components/schemas/uuid"
    description: Must match the UUID of the corresponding `component_version` object
    version:
    type: integer
    default: 1
    description: Collection version, incremented each time its content changes.
    update_reason:
    "$ref": "#/components/schemas/collection-update-reason"
    artifacts:
    type: array
    items:
    "$ref": "#/components/schemas/artifact"

@oej oej merged commit aec5596 into CycloneDX:main May 2, 2025
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants