Repository navigation
Align with TEA spec 1.0.0, keep 0.4.0 server compatibility - #34
Open
aurangzaib048 wants to merge 30 commits into
Open
aurangzaib048 wants to merge 30 commits into
aurangzaib048 wants to merge 30 commits into
Conversation
…t release Artifact rows tolerate a missing name, type, mediaType or url (TEA 1.0.0 server-hosted formats carry no url). Unpinned components resolve the release with the latest createdDate, since 1.0.0 lists releases oldest first.
…ngrade With version=None, from_well_known now builds its attempts from exact matches across every supported version (keeping cross-version failover) and only falls back to a compatible downgrade when none is advertised as-is. A server offering 0.4.0 and 1.0.0-rc.1 now negotiates 0.4.0 without a warning.
- Deeply nested JSON on 2xx API and .well-known responses raises TeaValidationError / TeaDiscoveryError instead of RecursionError. - Iterators follow nextPageToken past an empty page that still has hasNext; the seen-token set and page cap keep the loop bounded. - A non-string page_token raises TeaValidationError before any request. - TEA 1.0.0 pages must carry results. - Conformance discovery_404 on 1.0.0 requires a TEA error body.
Artifact downloads now refuse a redirect from an https hop to http, as discovery already does. Regression guards: basic auth is sent on the first hop and dropped on the redirect hop, and the same-host redirect test checks the first hop carried the bearer token.
…deferred items README Upgrading: Python-built models follow the 1.0.0 rules (use the legacy context for 0.4.0-shaped data), unsupported /v<semver> majors raise ValueError, dict keyword construction of ComponentReleaseWithCollection fails, and negotiation downgrades only without an exact match. FUTURE.md: a --spec-version override for the CLI and conformance tools, and bounding 3xx bodies that requests reads during downloads.
There was a problem hiding this comment.
🔵 Needs a closer look
The cross-version migration and authenticated download changes warrant human review, with unresolved conformance failures and live-server validation pending.
2 open issues
What changed in this PR
Updates libtea for TEA 1.0.0 while preserving 0.4.0 server compatibility.
Changes:
- Adds version-aware validation, discovery, and token pagination.
- Supports server-hosted artifact downloads with credential-safe redirects.
- Expands regression tests, conformance checks, and migration documentation.
| File | Description |
|---|---|
| tests/unit/test_validation.py | Tests validation context and legacy tokens. |
| tests/unit/test_protocols.py | Pins protocol tests to 0.4.0. |
| tests/unit/test_models.py | Covers version-aware models and pagination. |
| tests/unit/test_conformance_runner.py | Uses the legacy endpoint. |
| tests/unit/test_conformance_plugin.py | Updates legacy client expectations. |
| tests/unit/test_conformance_checks.py | Tests version-aware conformance checks. |
| tests/spec_data.py | Adds shared versioned fixtures. |
| tests/integration/test_integration.py | Updates distribution-field expectations. |
| tests/conftest.py | Adds separate version fixtures. |
| tests/client/test_iterators.py | Tests legacy offset continuation. |
| tests/client/test_http.py | Tests error parsing and nested JSON. |
| tests/client/test_download.py | Tests authenticated URL restrictions. |
| tests/client/test_discovery.py | Covers TEI parsing and negotiation. |
| tests/client/test_client.py | Updates legacy client regression tests. |
| tests/client/test_client_v1.py | Adds 1.0.0 client coverage. |
| tests/client/test_cache.py | Pins cache tests to 0.4.0. |
| tests/cli/test_cli_fmt.py | Tests updated model formatting. |
| src/libtea/protocols.py | Updates the client interface. |
| src/libtea/models.py | Adds version-aware schemas and pagination. |
| src/libtea/exceptions.py | Exposes request error types. |
| src/libtea/discovery.py | Supports TEI URIs and advertised versions. |
| src/libtea/conformance/plugin.py | Updates usage examples. |
| src/libtea/conformance/_checks.py | Adapts checks and adds token validation. |
| src/libtea/conformance/__init__.py | Updates conformance examples. |
| src/libtea/cli.py | Adds new discovery and download workflows. |
| src/libtea/_validation.py | Passes legacy context into validation. |
| src/libtea/_http.py | Adds authenticated downloads and bounded error parsing. |
| src/libtea/_cli_fmt.py | Updates pagination and field rendering. |
| src/libtea/__init__.py | Exports new models. |
| README.md | Documents compatibility and migration. |
| docs/FUTURE.md | Records deferred features and limitations. |
| docs/conformance.md | Documents version-aware checks. |
| docs/cli.md | Updates commands and examples. |
| CLAUDE.md | Updates architecture and development guidance. |
Review effort: Balanced
…ignment # Conflicts: # README.md
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing. Review the Copilot code review billing settings.
TEA 0.4.0 serves artifact metadata at /artifact/{uuid}; /artifact/{uuid}/latest
and /artifact/{uuid}/{version} exist only in 1.x. A live conformance run against
trust.sbomify.com (0.4.0) failed get_artifact with 404. get_artifact now picks the
path from the negotiated version, and get_artifact_version raises
TeaValidationError on 0.4.0 servers before any request.
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing. Review the Copilot code review billing settings.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Aligns libtea with TEA spec 1.0.0 (upstream
CycloneDX/transparency-exchange-apiat41e8586) while keeping 0.4.0 servers working. sbomify's own TEA servers (sbomify/sbomify,pypi-tea) still serve 0.4.0, so the client supports both instead of dropping 0.4.0.TeaClient.spec_version/is_legacy, taken fromspec_version=, the/v<semver>base-URL suffix, or the 1.0.0 default.from_well_known()negotiates 1.0.0 first, then 0.4.0, fails over across both, and keeps the advertised spelling (/v1.0.0+build.5)._v1_problemshook and relaxed for 0.4.0 servers via the{"tea_legacy": True}validation context.--checksum).page_offset→page_token,has_next/next_page_token, a newPaginatedCollectionResponse, and newly paginated release/collection lists. On 0.4.0 servers the token is the offset. Iterators guard against repeated tokens and stop after 10,000 pages.ProductReleaseWithCollectionis new),tei://TEIs alongsideurn:tei:, the 1.0.0 error types (unknown values tolerated,TeaRequestError.error_type).discover(purl=...),tea-cli discover --purl) and server-hosted artifact downloads (download_artifact_content). The token goes only to the API base, never on a redirect, and HTTPS→HTTP redirects are refused.pagination_token); discovery checks usetei://and require a TEA error body on 1.0.0. The search checks follow page tokens past empty 1.x pages.get_artifactnow calls/artifact/{uuid}, the only artifact endpoint 0.4.0 defines. libtea 0.5.1 called/artifact/{uuid}/latest, which 0.4.0 servers (includingtrust.sbomify.com) answer with 404.get_artifact_versionraisesTeaValidationErroron 0.4.0 servers, since 0.4.0 has no versioned artifact endpoint.Breaking Python API changes are listed in the README's new Upgrading section. Deferred 1.0.0 items (
/token, ETag/304, signature downloads, sort parameters,servers[]routing, a CLI--spec-versionoption) are indocs/FUTURE.md.Changes by layer
_v1_problemshook + legacy context, non-Optional both-version fields,Collection.created_date, generic paginated base +PaginatedCollectionResponse,ProductReleaseWithCollection, 1.0.0ErrorType, removed pre-0.4.0 shims (distribution_type(s),mimeType)page_tokenpagination,discover(purl=),download_artifact_content, empty-discovery check on 1.x, version-specific artifact pathRecursionErrormapped toTeaErrortei://parsing, exact-version preference before compatible downgrade--page-token,discover --purl,tei://download/inspect, server-hosted downloads,inspectfixes for 1.0.0 datapagination_tokencheck, 1.0.0-aware discovery checks (28 total)Test plan
/v0.4.0base URLs and still passes, as a 0.4.0 regression suiteruff check .cleanruff format --check .cleanmypycleantrust.sbomify.com/tea/v0.4.0):tea-cli conformancegives 17 pass, 11 skip (features that server doesn't offer, such as CLE and versioned collections), 0 fail. This run found the artifact-path bug above, which was fixed in0eff4bc.from_well_known("trust.sbomify.com")negotiates 0.4.0, and offset page tokens page through all 11 product releases.