CYcyclonedx
TEA Collection

Get the latest collection of a TEA Product Release

Changed on

Get the latest TEA Collection belonging to the TEA Product Release, that is, the collection with the greatest published version.

404 means the release is unknown; a release always has a latest collection.

get/productRelease/{uuid}/collection/latest

Request

  • Base URL
    http://localhost/tea/v1.0.0
  • Auth
    • HTTP bearer
    • or none

Path parameters

uuidstring uuid required

A UUID in lower case (RFC 9562)

UUID of TEA Product Release in the TEA server

Response

Requested TEA Collection found and returned

uuidstring uuid required

A UUID in lower case (RFC 9562)

versioninteger required

TEA Collection version, incremented by 1 each time its content changes. Versions start with 1. Content changes include replacing an embedded artifact with a newer revision (for example one published because an external url or signatureUrl changed). If a Collection adopts that new artifact revision, the server shall publish a new Collection version. Previously published Collection versions shall remain unchanged. Classification of that adoption follows collection-update-reason-type.

createdDatestring date-time required

Timestamp, RFC 3339 in UTC with the Z designator. Offsets are not accepted; servers shall convert to UTC before emitting. Fractional seconds are optional and preserved as sent. All timestamps in this specification use this schema.

belongsTo'COMPONENT_RELEASE' | 'PRODUCT_RELEASE' required

Indicates whether a collection belongs to a component release or a product release

Example response

{
  "uuid": "da89e38e-95e7-44ca-aa7d-f3b6b34c7fab",
  "version": 10,
  "createdDate": "2024-12-15T00:00:00Z",
  "belongsTo": "COMPONENT_RELEASE",
  "updateReason": {
    "type": "VEX_UPDATED",
    "comment": "VDR file updated"
  },
  "artifacts": [
    {
      "uuid": "1cb47b95-8bf8-3bad-a5a4-0d54d86e10ce",
      "createdDate": "2024-12-13T00:00:00Z",
      "version": 2,
      "name": "Build SBOM",
      "type": "BOM",
      "formats": [
        {
          "mediaType": "application/vnd.cyclonedx+xml",
          "description": "CycloneDX SBOM (XML)",
          "url": "https://repo.maven.apache.org/maven2/org/apache/logging/log4j/log4j-core/2.24.3/log4j-core-2.24.3-cyclonedx.xml",
          "signatureUrl": "https://repo.maven.apache.org/maven2/org/apache/logging/log4j/log4j-core/2.24.3/log4j-core-2.24.3-cyclonedx.xml.asc",
          "checksums": [
            {
              "algType": "SHA-256",
              "algValue": "e04c9d55986d7194822eaa4f8115a77f801844d807ad6e0d454ac31dd41861e5"
            },
            {
              "algType": "SHA-1",
              "algValue": "5a7d4caef63c5c5ccdf07c39337323529eb5a770"
            }
          ]
        }
      ]
    },
    {
      "uuid": "dfa35519-9734-4259-bba1-3e825cf4be06",
      "createdDate": "2024-12-15T00:00:00Z",
      "version": 7,
      "name": "Vulnerability Disclosure Report",
      "type": "VULNERABILITIES",
      "formats": [
        {
          "mediaType": "application/vnd.cyclonedx+xml",
          "description": "CycloneDX VDR (XML)",
          "url": "https://logging.apache.org/cyclonedx/vdr.xml",
          "checksums": [
            {
              "algType": "SHA-256",
              "algValue": "75b81020b3917cb682b1a7605ade431e062f7a4c01a412f0b87543b6e995ad2a"
            }
          ]
        }
      ]
    }
  ]
}

Changes

  • c69063d1dfffRevision changes
    • info

      api tag TEA Collection added

    • info

      api tag TEA Product Release removed

  • e476cd640edcRevision changes
    • info

      api tag TEA Product Release added

    • info

      api tag TEA Collection removed

    • info

      the /// response property dependentRequired was added for the status : when url is present, checksums are required