Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Enhancement request: Trigger `populate_purldb` pipeline in ScanCode.io on SBOM import

Aperta
  • Qualcosa non va?
#306 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
25/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Ferma
Stack tecnologico
python
Ambito
api, backend, devops

Direzione di ricerca

Inizia tracciando il punto di ingresso dell’importazione SBOM e le pipeline denominate load_sbom e populate_purldb; verifica innanzitutto il problema di dipendenza di ScanCode.io #1644. Mappa quindi le opzioni web/API, il completamento di PurlDB, Improve Packages from PurlDB e il successivo flusso di scansione. Il lavoro è completato quando l’importazione configurata completa questi passaggi senza interventi manuali in ScanCode.io.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

design needed enhancement

Is your enhancement request related to a problem? Please describe.
Currently DejaCode has trouble getting all necessary information for scanning package that have been imported from SBOMs. Most often not enough information are present to deduce the download URL. For references, see issues such as:

The issue stems from the fact the translation from PURL to URL is not always directly possible and may thus not be supported by purl2url and/or DejaCode is not using purl2url in all situations (it is used when manually adding a package but seemingly not when importing through SBOM). For example more elaborate logic is needed for Maven to determine what file needs to be downloaded, which may not be immediately clear from the PURL as the file could have a variety of potential file extensions. This issue can be addressed by using DejaCode, ScanCode.io, and PurlDB, where PurlDB is pulling the metadata of the package, which can then be used to enhance the package information in DejaCode.

Currently the step of gathering metadata for an SBOM requires manually creating an additional pipeline in ScanCode.io to run populate_purldb for the imported SBOM. My suggestion would be to offer an additional option for the SBOM import so that DejaCode triggers this pipeline automatically after running load_sbom. In a completely perfect solution, DejaCode would also allow to run "Improve Package from PurlDB" automatically, once PurlDB has concluded the gathering of metadata. This is needed to assign the download URLs to the package, otherwise the scanning of packages cannot be started

Note: For this to work, ScanCode.io first has to fix the bug in https://github.com/aboutcode-org/scancode.io/issues/1644 where populate_purldb fails if any dependencies are listed in the SBOM. This currently requires to manually edit the SBOM file and remove the dependencies array in the JSON file.

What are the benefits of the requested enhancement?

  • Users can import SBOM and have packages analyzed straight from DejaCode, without requiring additional manual steps or access to ScanCode.io
  • Allows fully automated CI/CD integration, where a product is created, SBOM uploads, metadata gathered and then all packages get scanned

Describe the solution you would like

  • Extend the project that is being created in ScanCode.io by a populate_purldb pipeline after the load_sbom pipeline
  • Run "Improve Packages from PurlDB" once the PurlDB has gather the metadata (unclear if this is technically possible)
  • Once the metadata has been added to the packages continue with scanning the packages
  • Provide options in the web view and API to configure if these two options should be enabled for an SBOM import

Additional notes
This feature together with the fix for ScanCode.io would greatly help to integrate this an automated CI workflow.

Lingua principale
Python
Stelle
52
Fork
30
Merge medio
4h 57m
PR unite (30g)
21

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di aboutcode-org/dejacode

Tutte le issue di aboutcode-org/dejacode

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.