Olle E. Johansson
Olle E. Johansson
This is the output from our last meeting and the brainstorm meeting
In an old slide I have a product pointing to a TEI for another product. Maybe that's still a valid solution for this.
I think many products have one "product" and a single "component". We knew that and it's the way to provide for the flexibility of having bundles.
For product to product relations we had TEI before. Maybe we need to add it again, so a product can consist of a set of (products and components)
Using a TEI makes it possible to include a product from another TEA service, maybe another vendor
> That's an interesting feature—can a TEI reference a TEA Component instead of a TEA Product? Not directly, but just create a separate TEA product with just one component and...
Supporting GPG signatures is good for backwards compatibility but do we want to put that implementation burden on new implementations, which this will be? Food for thought. Being able to...
Moved discussions on PGP to a separate issue
Added a clarification that digital signatures are optional. It may not be in future versions of the API, but we have to start somewhere.
Starting point to steal is here: https://github.com/CycloneDX/transparency-exchange-api/blob/main/api-flow/consumer.md