Transparency Exchange API: Where To Find Product SBOM?
summary
TEA proposes a decentralized, API-first way to discover product SBOMs and related artifacts, aiming for ECMA then ISO standardization. It maps products → product releases → component releases and serves artifact collections versioned per release; the demo resolves Apache Log4j releases and fetches real CycloneDX SBOMs using Transparency Exchange API (TEA) and CycloneDX SBOMs. Discovery uses OpenAPI discovery endpoints and a Transparency Exchange Identifier (TI) (UUID or package URL) to locate a manufacturer-controlled server (self-hosted or service) and retrieve artifacts.
AI-written summary · about
chapters (12)
- 0:00Transparency Exchange API intro
- 1:06SBOMs and EU CRA
- 3:37Manufacturer SBOM management
- 6:11SBOM mapping challenges
- 8:03Product Component Data Model
- 10:37Populating SBOMs upstream
- 12:45Compliance and supply chain security
- 13:48API key features
- 15:57Technical details and TEI
- 17:26Live SBOM retrieval demo
- 21:44Future steps and standardization
- 22:31Closing
related talks
51mThe Opposite of Transparency
30mTransparency in the Software Supply Chain: Making SBOM a Reality
26mSBOM Open Questions
40mHow I Learned to Stop Worrying and Love the SBOM
40mDBOM and SBOM: New Options For Better Supply Chain Cybersecurity
38mEnhancing SBOM Generation: Filling the Gaps To Make Actionable SBO...
39mSBOM Automation - Making Compliance Effortless by Consuming, Enrichin...
27mSBOM: The Rest Of the Story