Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

Enhancement request: Trigger `populate_purldb` pipeline in ScanCode.io on SBOM import

オープン
  • 何か問題がありますか？
#306 コメント 1 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
5/5
見積もり時間
1週間以上
初心者へのやさしさ
25/100
issue の種類
機能追加
明瞭さ
おおむね明確
活発さ
停滞
技術スタック
python
領域
api, backend, devops

調査の方向性

まず、SBOM インポートのエントリポイントと、名前付きの load_sbom および populate_purldb パイプラインを追跡します。最初に ScanCode.io の依存関係の問題 #1644 を確認してください。次に、web/API オプション、PurlDB の完了、Improve Packages from PurlDB、およびその後のスキャンフローを整理します。設定されたインポートが、ScanCode.io で手動作業を行わずにこれらの手順を完了できれば完了です。

索引モデルが issue の本文から書いたものです。

説明

design needed enhancement

Is your enhancement request related to a problem? Please describe.
Currently DejaCode has trouble getting all necessary information for scanning package that have been imported from SBOMs. Most often not enough information are present to deduce the download URL. For references, see issues such as:

The issue stems from the fact the translation from PURL to URL is not always directly possible and may thus not be supported by purl2url and/or DejaCode is not using purl2url in all situations (it is used when manually adding a package but seemingly not when importing through SBOM). For example more elaborate logic is needed for Maven to determine what file needs to be downloaded, which may not be immediately clear from the PURL as the file could have a variety of potential file extensions. This issue can be addressed by using DejaCode, ScanCode.io, and PurlDB, where PurlDB is pulling the metadata of the package, which can then be used to enhance the package information in DejaCode.

Currently the step of gathering metadata for an SBOM requires manually creating an additional pipeline in ScanCode.io to run populate_purldb for the imported SBOM. My suggestion would be to offer an additional option for the SBOM import so that DejaCode triggers this pipeline automatically after running load_sbom. In a completely perfect solution, DejaCode would also allow to run "Improve Package from PurlDB" automatically, once PurlDB has concluded the gathering of metadata. This is needed to assign the download URLs to the package, otherwise the scanning of packages cannot be started

Note: For this to work, ScanCode.io first has to fix the bug in https://github.com/aboutcode-org/scancode.io/issues/1644 where populate_purldb fails if any dependencies are listed in the SBOM. This currently requires to manually edit the SBOM file and remove the dependencies array in the JSON file.

What are the benefits of the requested enhancement?

  • Users can import SBOM and have packages analyzed straight from DejaCode, without requiring additional manual steps or access to ScanCode.io
  • Allows fully automated CI/CD integration, where a product is created, SBOM uploads, metadata gathered and then all packages get scanned

Describe the solution you would like

  • Extend the project that is being created in ScanCode.io by a populate_purldb pipeline after the load_sbom pipeline
  • Run "Improve Packages from PurlDB" once the PurlDB has gather the metadata (unclear if this is technically possible)
  • Once the metadata has been added to the packages continue with scanning the packages
  • Provide options in the web view and API to configure if these two options should be enabled for an SBOM import

Additional notes
This feature together with the fix for ScanCode.io would greatly help to integrate this an automated CI workflow.

主要言語
Python
スター
52
フォーク
30
平均マージ
4時間 57分
マージ済み PR（30日）
21

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

aboutcode-org/dejacode のほかの issue

aboutcode-org/dejacode の issue をすべて見る

似ている issue

Python の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。