Skip to content

Advance TEA to Beta 2 #209

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
oej merged 2 commits into from
Dec 18, 2025
Merged

Advance TEA to Beta 2 #209

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3d0f0ca
docs: advance TEA to Beta 2
taleodor Nov 24, 2025
faa235d
fix: use TEA Artifact named term where applicable
taleodor Dec 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 17 additions & 14 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,13 +14,10 @@ formed - TC54 TG1. The working group has a slack channel in the CycloneDX slack

![](images/tealogo.png)

## Status of the standard: Beta 1
## Status of the standard: Beta 2

TEA is now in beta 1. This beta focuses on the consumer side of the API. Work on the
publisher API will start after the beta. The idea is to get implementation feedback
early on the current specification in order to move forward towards a first official
version of the standard. Feedback will be gathered in the Hackathon at OWASP AppSec
Global in Barcelona May 28 as well as in the meetings and slack channel.
TEA is now in beta 2. This beta focuses on ready-to-implement consumer side of the API. Work on the
publisher API will start after the 1.0 release.

We encourage developers to start with both client and server implementations of TEA and
participate in interoperability tests. These will be organised both as hackathons and
Expand All @@ -29,19 +26,25 @@ informally using the Slack channel.
There will likely be multiple beta releases. We will announce these by adding new
tags in the repository as well as in the slack channel.

Priority issues for Beta 3:
- Refinement of distribution types and distributionType fields, see https://github.com/CycloneDX/transparency-exchange-api/issues/198
- CLE Spec needs to be integrated in TEA
- E2e poc of authn/z workflow with TEA consumer spec, including consumer spec adjustment to better support authn/z
- Compliance document workflow, see https://github.com/CycloneDX/transparency-exchange-api/issues/205

## Introduction

This specification defines a standard, format agnostic, API for the exchange of
product related artifacts, like BOMs, between systems. The work includes:
product related artefacts, like BOMs, between systems. The work includes:

- [Discovery of servers](/discovery/readme.md): Describes discovery using the Transparency Exchange Identifier (TEI)
- Retrieval of artifacts
- Publication of artifacts
- Retrieval of artefacts
- Publication of artefacts
- Authentication and authorization
- Querying

System and tooling implementors are encouraged to adopt this API standard for
sending/receiving transparency artifacts between systems.
sending/receiving transparency artefacts between systems.
This will enable more widespread
"out of the box" integration support in the BOM ecosystem.

Expand All @@ -56,13 +59,13 @@ The working group has produced a list of use cases and requirements for the prot
- [TEA Product Release](tea-product/tea-product-release.md): The primary entry point. The [Transparency Exchange Identifier, TEI](/discovery/readme.md) resolves to a specific Product Release. A Product Release may optionally belong to a [TEA Product](tea-product/tea-product.md).
- [TEA Product](tea-product/tea-product.md): An optional higher-level object that groups a set of Product Releases for a product line or family. Products can be discovered and browsed; releases are accessed via `/product/{uuid}/releases`.
- [TEA Component](tea-component/tea-component.md): Represents a component lineage. A Component is a collection of Component Releases (accessible via `/component/{uuid}/releases`).
- [TEA Release](/tea-component/tea-release.md: A Component Release object. Each Component Release may have its own TEA Collection.
- [TEA Release](/tea-component/tea-release.md): A Component Release object. Each Component Release may have its own TEA Collection.
- [TEA Collection](tea-collection/tea-collection.md): A versioned list of artefacts for a specific Release (Component Release) or Product Release. Collections are versioned to indicate changes, e.g., an updated VEX or corrected SBOM.
- [TEA Artefacts](tea-artifact/tea-artifact.md): Files associated with a Collection. A single Artefact can appear in multiple Collections.
- [TEA Artifacts](tea-artifact/tea-artifact.md): Files associated with a Collection. A single TEA Artifact can appear in multiple Collections. Note that a TEA Artifact is a named term introduced by the TEA standard.

## artifacts available of the API
## Artefacts available of the API

The Transparency Exchange API (TEA) supports publication and retrieval of a set of transparency exchange artifacts. The API itself should not be restricting the types of the artifacts. A few examples:
The Transparency Exchange API (TEA) supports publication and retrieval of a set of transparency exchange artefacts. The API itself should not be restricting the types of the artefacts. A few examples:

### xBOM

Expand Down