Hacktoberfest 2026 : les issues que les mainteneurs ont marquées pour octobre, ouvertes et accessibles aux débutants. Parcourir les issues Hacktoberfest

BUG: DejaCode exported CycloneDX SBOM does not retain dependency relationship

Ouverte
  • Quelque chose ne va pas ?
#271 3 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
4/5
Temps estimé
3-5 jours
Accessibilité débutants
35/100
Type d'issue
Bug
Clarté
Plutôt claire
Activité
À l'abandon
Stack technique
python
Domaine
security

Piste de recherche

Reproduisez le workflow via Actions > Load packages from SBOMs et Share > CycloneDX à l’aide d’une SBOM CycloneDX 1.6 avec des dépendances transitives. Comparez l’inventaire importé et les relations de dépendance avec les dépendances exportées et examinez l’issue associée #122. Le travail est terminé lorsque l’importation préserve la distinction entre les dépendances directes et indirectes et que l’exportation émet chaque package avec des références dependsOn vers ses dépendances réelles.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

bug design needed enhancement HighPriority td

Describe the bug
Current DejaCode versions already represent the relationships between packages in a product's inventory and their dependencies with other packages. However, when exporting an SBOM that relationship is not correctly represented in the resulting file. This was tested with CycloneDX as output format.

The resulting file list all packages as if they are direct dependencies. This is incorrect, has some may only be transitive dependencies. This is highly important to get right for regulatory purposes as it indicates who is responsible for fixing issues or updating versions. If it is a direct dependency then the organisation developing the product is directly responsible. However, if a dependency of the product has transitive dependencies where a package is outdated, then the organisation developing the product may have to wait for a patch of that dependency to be released. Furthermore, displaying transitive dependencies as direct dependencies is simply inaccurate for the purpose of software component analysis.

To Reproduce

  1. Create a product in DejaCode
  2. Generate an SBOM for a product with a tool such as cdxgen, where there are transitive dependencies
  3. Use "Actions > Load packages from SBOMs" with "Scan all packages of this product post-import" checked
  4. Once the import is completed you should see the inventory populated and dependencies filled
  5. Use "Share > CycloneDX" to export an SBOM in format version 1.6
  6. Open the SBOM in an editor of your choice an see that all packages are listed as direct dependencies under the key "dependencies" and within that "dependsOn".

Expected behavior
Instead of having all packages listed in "dependsOn" as direct dependencies, they should be listed as follow:

  • All dependencies should each have an entry like: 
    {
    "ref": "pkg:pkgmanager/[email protected]",
    "dependsOn": []
},
  • "dependsOn" should reference the PURLs of other packages that they depend on, if any (just like dependencies already do in DejaCode's internal model)

Important: The SBOM import must also ensure that only direct dependencies are listed as packages in the inventory and indirect/transitive dependencies are listed as dependecies. Otherwise this cannot be fixed afterwards. Hence, this issue is related to https://github.com/aboutcode-org/dejacode/issues/122

Screenshots
n.a.

Context (OS, Browser, Device, etc.):
n.a.

Langage dominant
Python
Étoiles
52
Forks
30
Merge moyen
4 h 57 min
PR mergées (30 j)
21

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de aboutcode-org/dejacode

Toutes les issues de aboutcode-org/dejacode

Issues similaires

Plus d'issues Python

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.