Multipage preference

4 Terms and definitions

4.1 Terms

For the purposes of this Standard, the following terms and definitions apply:

4.1.1 Attestation

machine-readable statement containing facts, evidence, or testimony

4.1.2 Authentication

authn

process of verifying the identity of a principal

4.1.3 Authorization

authz

process of determining what a verified principal is permitted to do

4.1.4 Collection

versioned list of the TEA Artifacts of one Component Release or one Product Release

Note

A Collection has the same UUID as the release to which it belongs. A change to its content produces a new version, which records the reason for the change.

4.1.5 Compliance document

document describing the compliance, certification or regulatory status of a Component, for example a SOC 2 report

Note

A compliance document is published as a TEA Artifact of a Component Release. The Component or Component Release is marked with the COMPLIANCE_DOCUMENT identifier type so that it can be discovered.

4.1.6 Component

software or hardware item whose successive versions are Component Releases

Note

A Product Release can reference Components and specific Component Releases.

4.1.7 Component Release

specific version of a Component

Note

Each Component Release has its own Collection.

4.1.8 Discovery document

JSON document served at /.well-known/tea on the host named by the domain name of a TEI, listing the TEA server endpoints for that domain and the API versions they support

4.1.9 Product

item sold, distributed or otherwise delivered under one name

4.1.10 Product Release

specific version of a Product that can be acquired or downloaded

4.1.11 Software bill of materials

SBOM

structured inventory of the software components of a product, with their versions, identifiers and dependencies

4.1.12 TEA Artifact

security-related document, such as an SBOM, a VEX document or an attestation, published in one or more formats and identified by a UUID and a version

4.1.13 TEA client

software that retrieves information from a TEA server using the API defined in this Standard

4.1.14 TEA server

server that implements the API defined in this Standard

4.1.15 Transparency Exchange Identifier

TEI

URI of the form tei://<domain-name>/<type>/<unique-identifier> that identifies one or more Product Releases

Note

The domain name of a TEI is used to locate the TEA server; see Clause 5.

4.1.16 Vendor

party that publishes TEIs for its Product Releases

Note

A vendor can be a commercial company or an open source project.

4.1.17 Vulnerability Exploitability eXchange document

VEX document

document stating, for a product, the exploitability status of known vulnerabilities

Note

A VEX document states, for example, whether a vulnerability affects the product, does not affect it, or is mitigated.

4.2 Acronyms and abbreviations

For the purposes of this Standard, the following abbreviations apply:

Table 1: Acronyms & abbreviations
Abbreviation  
API Application Programming Interface
CPE Common Platform Enumeration, a naming scheme for IT products and platforms, usable as an identifier type
CSAF Common Security Advisory Framework, an OASIS standard for machine-readable security advisories
EAN International Article Number (formerly European Article Number); an EAN-13 or EAN-8 number is a GTIN of 13 or 8 digits
GTIN Global Trade Item Number, the GS1 identification key for trade items, of 8, 12, 13 or 14 digits
SBOM Software bill of materials
TEA Transparency Exchange API
TEI Transparency Exchange Identifier
UPC Universal Product Code; a UPC-A number is a GTIN of 12 digits
UUID Universally Unique Identifier
VDR Vulnerability Disclosure Report
VEX Vulnerability Exploitability eXchange