Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

BUG: DejaCode exported CycloneDX SBOM does not retain dependency relationship

Abierto
  • ¿Algo no está bien?
#271 3 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
35/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Estancado
Stack tecnológico
python
Área
security

Línea de trabajo

Reproduce el flujo de trabajo mediante Actions > Load packages from SBOMs y Share > CycloneDX usando una SBOM CycloneDX 1.6 con dependencias transitivas. Compara el inventario importado y las relaciones de dependencia con las dependencias exportadas y revisa el issue relacionado #122. Se considera terminado cuando la importación conserva la distinción entre dependencias directas e indirectas y la exportación emite cada paquete con referencias dependsOn a sus dependencias reales.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

bug design needed enhancement HighPriority td

Describe the bug
Current DejaCode versions already represent the relationships between packages in a product's inventory and their dependencies with other packages. However, when exporting an SBOM that relationship is not correctly represented in the resulting file. This was tested with CycloneDX as output format.

The resulting file list all packages as if they are direct dependencies. This is incorrect, has some may only be transitive dependencies. This is highly important to get right for regulatory purposes as it indicates who is responsible for fixing issues or updating versions. If it is a direct dependency then the organisation developing the product is directly responsible. However, if a dependency of the product has transitive dependencies where a package is outdated, then the organisation developing the product may have to wait for a patch of that dependency to be released. Furthermore, displaying transitive dependencies as direct dependencies is simply inaccurate for the purpose of software component analysis.

To Reproduce

  1. Create a product in DejaCode
  2. Generate an SBOM for a product with a tool such as cdxgen, where there are transitive dependencies
  3. Use "Actions > Load packages from SBOMs" with "Scan all packages of this product post-import" checked
  4. Once the import is completed you should see the inventory populated and dependencies filled
  5. Use "Share > CycloneDX" to export an SBOM in format version 1.6
  6. Open the SBOM in an editor of your choice an see that all packages are listed as direct dependencies under the key "dependencies" and within that "dependsOn".

Expected behavior
Instead of having all packages listed in "dependsOn" as direct dependencies, they should be listed as follow:

  • All dependencies should each have an entry like: 
    {
    "ref": "pkg:pkgmanager/[email protected]",
    "dependsOn": []
},
  • "dependsOn" should reference the PURLs of other packages that they depend on, if any (just like dependencies already do in DejaCode's internal model)

Important: The SBOM import must also ensure that only direct dependencies are listed as packages in the inventory and indirect/transitive dependencies are listed as dependecies. Otherwise this cannot be fixed afterwards. Hence, this issue is related to https://github.com/aboutcode-org/dejacode/issues/122

Screenshots
n.a.

Context (OS, Browser, Device, etc.):
n.a.

Lenguaje dominante
Python
Estrellas
52
Forks
30
Merge medio
4 h 57 min
PR fusionados (30 d)
21

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de aboutcode-org/dejacode

Todos los issues de aboutcode-org/dejacode

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.