Skip to content

Clarify TEA Component Release fields#136

Merged
oej merged 6 commits intoCycloneDX:mainfrom
ppkarwasz:feat/clarify-component-release
May 8, 2025
Merged

Clarify TEA Component Release fields#136
oej merged 6 commits intoCycloneDX:mainfrom
ppkarwasz:feat/clarify-component-release

Conversation

@ppkarwasz
Copy link
Contributor

  • Fixes the fields in the TEA Component Release object, based on those listed in the OpenAPI spec.
  • Synchronizes the descriptions used in tea-collection.md and the OpenAPI spec.
  • Adds four examples of releases of the same TEA Component (Apache Tomcat) that differ in packaging, version numbers and presence of the pre-release flag.

ppkarwasz added 2 commits May 7, 2025 09:26
Synchronizes the fields of the TEA Component Release between the OpenSpec and Markdown documents.

Signed-off-by: Piotr P. Karwasz <piotr@github.copernik.eu>
Adds examples of TEA Collection Release objects, based on Apache Tomcat packages.

Signed-off-by: Piotr P. Karwasz <piotr@github.copernik.eu>
@ppkarwasz ppkarwasz requested review from madpah and oej as code owners May 7, 2025 08:06
@ppkarwasz ppkarwasz mentioned this pull request May 7, 2025
@ppkarwasz ppkarwasz changed the title Clarify TEA Component Object fields Clarify TEA Component Release fields May 7, 2025
@taleodor
Copy link
Contributor

taleodor commented May 7, 2025

I believe this:

        # Apache Tomcat 11.0.6
        - uuid: 605d0ecb-1057-40e4-9abf-c400b10f0345
          version: "11.0.6"
          release_date: 2025-04-01T15:43:00Z
          identifiers:
            - idType: purl
              idValue: pkg:maven/org.apache.maven/maven@11.0.6?type=zip

and this

        # Different packaging of Apache Tomcat 11.0.6
        # Will have slightly different SBOM
        - uuid: a9570065-9fc6-4d35-97b4-4bc67d68dbcd
          version: "11.0.6"
          release_date: 2025-04-01T15:43:00Z
          identifiers:
            - idType: purl
              idValue: pkg:maven/org.apache.maven/maven@11.0.6?classifier=windows-x64&type=zip

should be a single release. In any case, as discussed we should have a conversation on this. There should be either one level above the release or one level down from the release to support this properly. Today's common understanding of the world release is that there should be one level down.

Signed-off-by: Piotr P. Karwasz <piotr@github.copernik.eu>
@ppkarwasz
Copy link
Contributor Author

@taleodor,

I removed this example in e173892, we'll talk about it in #131:

# Different packaging of Apache Tomcat 11.0.6
# Will have slightly different SBOM
- uuid: a9570065-9fc6-4d35-97b4-4bc67d68dbcd
  version: "11.0.6"
  release_date: 2025-04-01T15:43:00Z
  identifiers:
    - idType: purl
      idValue: pkg:maven/org.apache.maven/maven@11.0.6?classifier=windows-x64&type=zip

ppkarwasz added 3 commits May 7, 2025 18:35
Signed-off-by: Piotr P. Karwasz <piotr@github.copernik.eu>
Signed-off-by: Piotr P. Karwasz <piotr@github.copernik.eu>
Signed-off-by: Piotr P. Karwasz <piotr@github.copernik.eu>
@ppkarwasz
Copy link
Contributor Author

@taleodor, can you review it again?

@taleodor
Copy link
Contributor

taleodor commented May 7, 2025

Thank you, looks great to me!

@oej oej merged commit d36672d into CycloneDX:main May 8, 2025
2 checks passed
@ppkarwasz ppkarwasz deleted the feat/clarify-component-release branch May 8, 2025 08:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants