Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Enhancement request: Retain transitive relationship between packages when importing SBOM

Abierto
  • ¿Algo no está bien?
#122 10 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
30/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Estancado
Stack tecnológico
python
Área
security

Línea de trabajo

Comienza con los archivos adjuntos sbom-1-4-formatted.cdx.json y dejacode_beta-systems_product_dejacode-transitive-dependencies-3_0.0.1.cdx.json, comparando las relaciones de dependencia que se aplanan durante la importación y la exportación. Se considera terminado cuando la asignación con ámbito de producto conserva las dependencias transitivas y las excluidas intencionadamente, de modo que una nueva exportación mantenga la jerarquía importada.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

design needed enhancement PackageSet

Is your enhancement request related to a problem? Please describe.
DejaCode allows to load packages associated with a product from an SBOM. A modern SBOM that fulfills requirements such as BSI TR-03183 will have to list transitive dependencies, meaning that not just the immediate dependencies used by the product are included, but also the ones they depend on and so on until all indirect dependencies are listed as well. When DejaCode imports the packages from the SBOM it only associates them directly with the product, all information about the transitive nature between packages is completely lost. The SBOM exported from DejaCode will list all dependencies as if they were direct dependencies of the product. As such it is not an accurate SBOM and does not fulfill current regulations.

What are the benefits of the requested enhancement?
The exported SBOM would provide accurate information. Currently, it does not reflect the actual status of the dependencies and as such is not an SBOM that fulfills regulation such as the Cyber Resilience Act or NTIA Minimum Elements for a Software Bill of Materials persuant to Executive Order 14028 as well as other national standards/technical guidelines.

Describe the solution you would like
It would be highly important that DejaCode retains the relationships between packages by storing the hierarchy in the context of the product. The exported SBOM for the product should retain the hierarchy that was provided when importing the SBOM.

The indirect dependencies for a package may seem fixed for a particular package version that is a direct dependency. However, there are uses cases where some of the transitive dependencies could get intentionally excluded, especially for Java software. Thus my recommendation would be to have this mapping in the product and not in the package itself.

Additional notes
Example data for an SBOM imported into DejaCode and the result after exporting it. Notice that dependencies has turned into a flat list.

Imported SBOM:

Exported SBOM:

Lenguaje dominante
Python
Estrellas
52
Forks
30
Merge medio
4 h 57 min
PR fusionados (30 d)
21

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de aboutcode-org/dejacode

Todos los issues de aboutcode-org/dejacode

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.