Skip to content

Commit 1efbd4d

Browse files
committed
Update core README
Signed-off-by: Olle E. Johansson <[email protected]>
1 parent e62880d commit 1efbd4d

File tree

1 file changed

+16
-10
lines changed

1 file changed

+16
-10
lines changed

README.md

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -32,16 +32,16 @@ tags in the repository as well as in the slack channel.
3232
## Introduction
3333

3434
This specification defines a standard, format agnostic, API for the exchange of
35-
product related artefacts, like BOMs, between systems. The work includes:
35+
product related artifacts, like BOMs, between systems. The work includes:
3636

3737
- [Discovery of servers](/discovery/readme.md): Describes discovery using the Transparency Exchange Identifier (TEI)
38-
- Retrieval of artefacts
39-
- Publication of artefacts
38+
- Retrieval of artifacts
39+
- Publication of artifacts
4040
- Authentication and authorization
4141
- Querying
4242

4343
System and tooling implementors are encouraged to adopt this API standard for
44-
sending/receiving transparency artefacts between systems.
44+
sending/receiving transparency artifacts between systems.
4545
This will enable more widespread
4646
"out of the box" integration support in the BOM ecosystem.
4747

@@ -54,13 +54,19 @@ The working group has produced a list of use cases and requirements for the prot
5454

5555
## Data model
5656

57-
- [TEA Product](tea-product/tea-product): This is the starting point. A "product" is something for sale or distributed as an Open Source project. The [Transparency Exchange Identifier, TEI](/discovery/readme.md) points to a single product.
58-
- [TEA Component index](tea-component/tea-component.md): A Component index is a version entry. The Component version index has one entry per version of the product.
59-
- [TEA Collection](tea-collection/tea-collection.md): The collection is a list of artefacts for a specific version. The collection can be dynamic or static, depending on the implemenation.
57+
- [TEA Product](tea-product/tea-product): This is the starting point. A "product" is something for sale or distributed as an Open Source project. The [Transparency Exchange Identifier, TEI](/discovery/readme.md) points to a single product. A product can have multiple TEIs.
58+
- [TEA Component](tea-component/tea-component.md): A Component is a versioned part of the product. In many cases, the product has a single component,
59+
and in other cases a product consists of multiple components.
60+
- TEA Components has a list of "releases" for each component.
61+
- [TEA Collection](tea-collection/tea-collection.md): The collection is a list of artifacts for a specific release. The collection can be
62+
dynamic or static, depending on the implemenation. TEA collections are versioned to indicate a change for a specific release,
63+
like an update of a VEX file or a correction of an SBOM.
64+
- [TEA Artifacts](tea-artifact/tea-artifact.md): The artifact is a file associated with the collection. One artifact can be part of many collections,
65+
for multiple components.
6066

61-
## Artefacts available of the API
67+
## artifacts available of the API
6268

63-
The Transparency Exchange API (TEA) supports publication and retrieval of a set of transparency exchange artefacts. The API itself should not be restricting the types of the artefacts. A few examples:
69+
The Transparency Exchange API (TEA) supports publication and retrieval of a set of transparency exchange artifacts. The API itself should not be restricting the types of the artifacts. A few examples:
6470

6571
### xBOM
6672

@@ -78,7 +84,7 @@ Vulnerability Disclosure Reports (VDR) and Vulnerability Exploitability eXchange
7884

7985
Product lifecycle events that are captured and communicated through the Common Lifecycle Enumeration will be supported. This includes product rebranding, repackaging, mergers and acquisitions, and product milestone events such as end-of-life and end-of-support.
8086

81-
### Insights
87+
## Insights
8288

8389
Much of the focus on Software Transparency from the U.S. Government and others center around the concept of “full transparency”. Consumers often need to ingest, process, and analyze SBOMs or VEXs just to be able to answer simple questions such as:
8490

0 commit comments

Comments
 (0)