Attachment of optional informational component references to Component Version

[mandelsoft]

Problem:

A component version has the possibility to refer to other component versions. Those reference explicitly extend the
set of resources formally described by a component version. Those resources contribute to the described artifact set of a component version, they are covered by the signing and transport process.

Besides those kinds of references it is useful to have the possibility to describe loose relations to other component versions.
This information might be signature relevant or not, but the content will never be part of the component version hosting this kind of reference.

Solution Idea:

Labels can be used to attach dynamic information to a component version and specify whether this information should be signature relevant or not. The desired functionality can be achieved to add a new label type and format to describe those informational references.

Specification:

Label Specification

We propose the following Specification for the new type of label:

Label Type: relatedComponentVersions
Format Version: v1

Format: []reference

reference:
component (string) required: the name of the component
version (string) required: the version of the component
purposes ([]purpose) optional: list of formal purposes for the component reference

purpose:
name: (string) required: the name of the purpose (see below)
version (string) optional: format version of the value specified
value: (any) optional: additional attributes for the purpose

Purposes

Purposes have a dedicated meaning represented by the purpose name. They are namespaced using DNS domain names followed by slash (/) separated name components to enable the extensibility by independent players.

Purposes defined by the Open Component Model are namespaceless.

CLI Commands

By using a dedicated label type for this kind of information, the CLI can be extended to provide this kind of information.
Commands listing references should be extended (by additional option (--related)) to include related component version in the output.
The information shown per reference must be extended to indicate those references as related.

First of all, the ocm get references is involved here.
The ocm get resources/sources commands should not be extended, because the attached component versions do not formally contribute to the content of a component version.

[github-actions]

This issue was marked as stale because it has not had recent activity.