Skip to content

Commit c8d8507

Browse files
committed
Small updates
Signed-off-by: Olle E. Johansson <oej@edvina.net>
1 parent ba1e5d8 commit c8d8507

1 file changed

Lines changed: 15 additions & 10 deletions

File tree

README.md

Lines changed: 15 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,11 @@
66
[![ECMA TC54](https://img.shields.io/badge/ECMA-TC54-FC7C00?labelColor=404040)](https://tc54.org)
77
[![ECMA TC54](https://img.shields.io/badge/ECMA-TC54--TG1-FC7C00?labelColor=404040)](https://ecma-international.org/task-groups/tc54-tg1/)
88

9-
# CycloneDX Transparency Exchange API Standard
9+
# OWASP Transparency Exchange API Standard
1010

11-
The Transparency Exchange API (TEA) is being worked on within the CycloneDX community
12-
with the goal to standardise the API in ECMA. A working group within ECMA TC54 has been
13-
formed - TC54 TG1. The working group has a slack channel in the CycloneDX slack space.
11+
The Transparency Exchange API (TEA) is being worked on within the ECMA TC54 tg 1
12+
with the goal to standardise the API in ECMA.
13+
The working group has a slack channel in the CycloneDX slack space.
1414

1515
![](images/tealogo.png)
1616

@@ -23,17 +23,20 @@ We encourage developers to start with both client and server implementations of
2323
participate in interoperability tests. These will be organised both as hackathons and
2424
informally using the Slack channel.
2525

26-
There will likely be multiple beta releases. We will announce these by adding new
27-
tags in the repository as well as in the slack channel.
2826

29-
Priority issues for Beta 3:
27+
Priority issues for v1.0:
3028
- Refinement of distribution types and distributionType fields, see https://github.com/CycloneDX/transparency-exchange-api/issues/198
3129
- CLE Spec needs to be integrated in TEA
3230
- E2e poc of authn/z workflow with TEA consumer spec, including consumer spec adjustment to better support authn/z
3331
- Compliance document workflow, see https://github.com/CycloneDX/transparency-exchange-api/issues/205
3432

3533
## Introduction
3634

35+
The TEA API is created to support automation of the software supply chain. Upstream
36+
vendors and open source projects can use this standard to keep downstream consumers
37+
up to date with transparency artefacts such as, but not limited to, bill of materials,
38+
VEX files, attestations and much more.
39+
3740
This specification defines a standard, format agnostic, API for the exchange of
3841
product related artefacts, like BOMs, between systems. The work includes:
3942

@@ -67,7 +70,7 @@ The working group has produced a list of use cases and requirements for the prot
6770

6871
The Transparency Exchange API (TEA) supports publication and retrieval of a set of transparency exchange artefacts. The API itself should not be restricting the types of the artefacts. A few examples:
6972

70-
### xBOM
73+
### *xBOM
7174

7275
Bill of materials for any type of component and service are supported. This includes, but is not limited to, SBOM, HBOM, AI/ML-BOM, SaaSBOM, and CBOM. The API provides a BOM format agnostic way of publishing, searching, and retrieval of xBOM artefacts.
7376

@@ -92,6 +95,8 @@ Much of the focus on Software Transparency from the U.S. Government and others c
9295

9396
Insights allows for “limited transparency” that can be asked and answered using an expression language that can be tightly scoped or outcome-driven. Insights also removes the complexities of BOM format conversion away from the consumers. An object model derived from CycloneDX will be an integral part of this API, since the objects within CycloneDX are self-contained (thus API friendly) and the specification supports all the necessary xBOM types along with CDXA.
9497

98+
Insights will be integrated into the API after the 1.0 release.
99+
95100
## Presentations and videos
96101

97102
- You can find presentations in the repository in the [Presentations](/presentations) directory
@@ -105,8 +110,8 @@ Contributors are listed in the [Contributors](contributors.md) file.
105110
## Terminology
106111

107112
- API: Application programming interface
108-
- Authorization (authz):
109-
- Authentication (authn):
113+
- Authorization (authz): Which products/components that a user has the right to access
114+
- Authentication (authn): Credentials to get authorization
110115
- Collection: A set of artefacts representing a version of a product
111116
- Product: An item sold or delivered under one name
112117
- Product variant: A variant of a product

0 commit comments

Comments
 (0)