transparency-exchange-api

transparency-exchange-api copied to clipboard

Proposal for more RESTful URL Semantics for SBOM Retrieval

4

The current URL semantics for retrieving a BOM uses query parameters: ``` bom-retrieval-url = system-url "?" bom-identifier-query bom-identifier-query = "bomIdentifier=" bom-identifier bom-identifier = *( pchar / "/" / "?" )...

fedemengo

CoSWID and SWID BOM Support

2

Hello 👋. I have quickly reviewed the spec draft here and noticed that only CycloneDX and SPDX are identified. Is SWID, more specifically the compact CBOR alterntive [in IETF RFC9393](https://datatracker.ietf.org/doc/rfc9393/)...

aj-stein-nist

Closes #2

stevespringett

This allows polling for latest version of a BOM without having to retrieve it entirely.

coderpatros

Provide OpenAPI Spec for REST Endpoints

1

Provide OpenAPI Sped for REST Endpoints

rvsoni

Add Support of REST API Versioning.

rvsoni

A Bom Post API should accept a Bom payload as Base64 (URL Safe) encoded format. Dependency track application also accepts Bom JSON as Base64 Encoded data. Project CycloneDX/cyclonedx-bom-repo-server implemented Post...

rvsoni

Retrieve by PURL

3

Are you considering an endpoint that could be given a PURL and return a list of `bom-identifiers` for SBOMs that describe that PURL? It might also be useful to have...

iamwillbar

Need URN query

1

As a user, i do not know the URN of the SBOM I want to retrieve. This specification should define how I can determine the URN for an SBOM I...

fortresslabs

Reference MUD and provide compatibility statement

1

We need to reference [MUD](https://datatracker.ietf.org/doc/html/rfc8520) in the spec and provide a statement that says the BOM Exchange API is compatible with MUD, possibly providing an example of interop.

stevespringett