TEA Artifact

Download the signature of one TEA Artifact revision

Download the detached signature for one format of a specific revision of a specific TEA Artifact.

This is the counterpart of the artifact content endpoint, for TEA servers that host signatures themselves: a format that has no external signatureUrl is retrieved from here, selected by its mediaType. A format that has a signatureUrl is retrieved from that external location instead, and this endpoint is not required to serve it.

Signatures are per format: each format of a revision is a distinct sequence of bytes and therefore has its own signature. The mediaType parameter selects which format's signature is returned, not the format of the signature itself.

This specification makes no assumption about the signature technology in use, and does not model the signing algorithm, key, or certificate chain; the response is the signature as published. A client that cannot determine how to verify what it receives should treat the signature as unusable rather than as invalid.

404 distinguishes the cases by TEA error body: OBJECT_UNKNOWN when the artifact revision is unknown (or concealed), and SIGNATURE_NOT_FOUND when the revision exists but the selected format has no signature published. A server concealing an artifact from a client shall answer OBJECT_UNKNOWN for every sub-resource of it, including signatures.

When serving the signature itself (200), servers shall return a strong ETag for the HTTP representation selected after negotiation, including content coding, and shall honor If-None-Match with 304. ETag is the only conditional validator for these downloads. Servers that support HEAD for this operation shall return the same headers as GET without a response body. 302 redirects are outside conditional semantics: If-None-Match applies only to the TEA-hosted download response, not to following an external Location. Successful responses include Content-Location as an absolute URL of this versioned signature download including the mediaType query parameter. That URL identifies the revision and format; HTTP content coding can still be negotiated.

get/artifact/{uuid}/{artifactVersion}/signature/download

Path parameters

uuidstring uuid required

A UUID in lower case (RFC 9562)

UUID of TEA Artifact in the TEA server

artifactVersioninteger required

Version of TEA Artifact

Query parameters

mediaTypestring

Example:application/vnd.cyclonedx+json

Selects which of the artifact revision's formats the returned signature applies to, by that format's mediaType. This is the media type of the signed content, not of the signature. The parameter value is the media type itself, not a pre-encoded wire form. Clients shall apply query-parameter serialization once. Servers shall interpret the value after one query-decoding step.

Matching against a format's mediaType is case-insensitive for the type and subtype. Parameter names are compared case-insensitively; parameter values require exact equality. When omitted, the server selects a format of its choice. Requests that need a specific format's signature should supply this parameter. Successful responses include Content-Location with a mediaType query parameter naming the selected content format. An explicit mediaType can remove variation by Accept when it completely determines the signed format. It does not eliminate variation by Accept-Encoding; see artifact-vary.

Example after serialization: .../signature/download?mediaType=application%2Fvnd.cyclonedx%2Bjson

Headers

If-None-Matchstring

Conditional request validator (RFC 9110). For artifact and signature downloads, ETag is the only defined validator. Servers evaluate If-None-Match with the weak comparison function (RFC 9110 section 13.1.2) against the ETag of the representation selected after negotiation, including content-coding negotiation, and answer 304 when it matches. The corresponding 304 shall carry that representation's validator and shall carry Vary when the 200 would. When present, that ETag is a strong validator. Other validators are not defined for these operations.

Response

The detached signature for the selected format of the TEA Artifact revision.

The wire Content-Type is application/octet-stream unless the server knows a more specific media type for the signature it holds, in which case it returns that. The response content key is */* because that type may vary. This specification does not require servers to identify the signature technology. Content-Encoding, when present, names the HTTP content coding of the selected representation. Content-Location identifies the revision and format; HTTP content coding can still be negotiated. Vary follows artifact-vary.

Changes

Changed in 18 of the 136 revisions of this API.42228

Sep 23, 20264f09e14d1ee03See the full diff
- ●
  the optional response header Content-Encoding removed for the status 200
  optional-response-header-removed
- ●
  the optional response header Repr-Digest removed for the status 200
  optional-response-header-removed
- ●
  the optional response header Vary removed for the status 200
  optional-response-header-removed
Sep 23, 202603c7ffdc11d03See the full diff
- ●
  the optional response header Content-Encoding removed for the status 200
  optional-response-header-removed
- ●
  the optional response header Repr-Digest removed for the status 200
  optional-response-header-removed
- ●
  the optional response header Vary removed for the status 200
  optional-response-header-removed
Sep 20, 2026f698addb5d2b10See the full diff
- ○
  added the optional property to the response with the status
  response-optional-property-added
- ○
  added the optional property to the response with the status
  response-optional-property-added
- ○
  added the optional property to the response with the status
  response-optional-property-added
- ○
  added the optional property to the response with the status
  response-optional-property-added
- ○
  added the optional property to the response with the status
  response-optional-property-added
- ○
  removed the OBJECT_NOT_SHAREABLE enum value from the response property for the response status
  response-property-enum-value-removed
- ○
  removed the OBJECT_NOT_SHAREABLE enum value from the response property for the response status
  response-property-enum-value-removed
- ○
  removed the OBJECT_NOT_SHAREABLE enum value from the response property for the response status
  response-property-enum-value-removed
- ○
  removed the OBJECT_NOT_SHAREABLE enum value from the response property for the response status
  response-property-enum-value-removed
- ○
  removed the OBJECT_NOT_SHAREABLE enum value from the response property for the response status
  response-property-enum-value-removed
Sep 20, 202656e8a714854913See the full diff
- ▲
  removed the media type application/octet-stream for the response with the status
  response-media-type-removed
- ○
  added the new optional header request parameter If-None-Match
  new-optional-request-parameter
- ○
  added the media type */* for the response with the status
  response-media-type-added
- ○
  added the non-success response with the status
  response-non-success-status-added
Sep 20, 202676f1dba21cda122See the full diff
- ▲
  removed the media type */* for the response with the status
  response-media-type-removed
- ●
  the optional response header Content-Location removed for the status 200
  optional-response-header-removed
- ●
  deleted the header request parameter If-None-Match
  request-parameter-removed
- ○
  added the media type application/octet-stream for the response with the status
  response-media-type-added
- ○
  removed the non-success response with the status
  response-non-success-status-removed
Sep 18, 202694dbf123cf8811See the full diff
- ▲
  removed the media type application/octet-stream for the response with the status
  response-media-type-removed
- ○
  added the media type */* for the response with the status
  response-media-type-added
Sep 18, 20268d5f545b99202See the full diff
- ●
  the optional response header Vary removed for the status 200
  optional-response-header-removed
- ●
  the optional response header Vary removed for the status 304
  optional-response-header-removed
Sep 18, 2026ca2281a266792See the full diff
- ○
  added the new optional header request parameter If-None-Match
  new-optional-request-parameter
- ○
  added the non-success response with the status
  response-non-success-status-added
Sep 18, 2026772035fe69178See the full diff
- ●
  added the new INVALID_PAGE_TOKEN enum value to the response property for the response status
  response-property-enum-value-added
- ●
  added the new INVALID_PAGE_TOKEN enum value to the response property for the response status
  response-property-enum-value-added
- ●
  added the new INVALID_REQUEST enum value to the response property for the response status
  response-property-enum-value-added
- ●
  added the new INVALID_REQUEST enum value to the response property for the response status
  response-property-enum-value-added
- ●
  added the new NO_ACCEPTABLE_FORMAT enum value to the response property for the response status
  response-property-enum-value-added
- ●
  added the new NO_ACCEPTABLE_FORMAT enum value to the response property for the response status
  response-property-enum-value-added
- ●
  added the new SIGNATURE_NOT_FOUND enum value to the response property for the response status
  response-property-enum-value-added
- ●
  added the new SIGNATURE_NOT_FOUND enum value to the response property for the response status
  response-property-enum-value-added
Sep 18, 20265cbc102ffdf92See the full diff
- ●
  added the new NOT_IMPLEMENTED enum value to the response property for the response status
  response-property-enum-value-added
- ●
  added the new NOT_IMPLEMENTED enum value to the response property for the response status
  response-property-enum-value-added

Full history (18 revisions)