Enhancement request: Retain transitive relationship between packages when importing SBOM

Aberta
  • Algo errado?
#122 10 comentários 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
5/5
Tempo estimado
Mais de uma semana
Facilidade para iniciantes
30/100
Tipo de issue
Funcionalidade
Clareza
Razoavelmente clara
Status de atividade
Estagnada
Stack de tecnologia
python
Domínio
security

Direção de pesquisa

Comece pelos arquivos anexados sbom-1-4-formatted.cdx.json e dejacode_beta-systems_product_dejacode-transitive-dependencies-3_0.0.1.cdx.json, comparando as relações de dependência que são niveladas durante a importação e a exportação. O trabalho estará concluído quando o mapeamento com escopo no produto preservar as dependências transitivas e as intencionalmente excluídas, de modo que uma nova exportação mantenha a hierarquia importada.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

design needed enhancement PackageSet

Is your enhancement request related to a problem? Please describe.
DejaCode allows to load packages associated with a product from an SBOM. A modern SBOM that fulfills requirements such as BSI TR-03183 will have to list transitive dependencies, meaning that not just the immediate dependencies used by the product are included, but also the ones they depend on and so on until all indirect dependencies are listed as well. When DejaCode imports the packages from the SBOM it only associates them directly with the product, all information about the transitive nature between packages is completely lost. The SBOM exported from DejaCode will list all dependencies as if they were direct dependencies of the product. As such it is not an accurate SBOM and does not fulfill current regulations.

What are the benefits of the requested enhancement?
The exported SBOM would provide accurate information. Currently, it does not reflect the actual status of the dependencies and as such is not an SBOM that fulfills regulation such as the Cyber Resilience Act or NTIA Minimum Elements for a Software Bill of Materials persuant to Executive Order 14028 as well as other national standards/technical guidelines.

Describe the solution you would like
It would be highly important that DejaCode retains the relationships between packages by storing the hierarchy in the context of the product. The exported SBOM for the product should retain the hierarchy that was provided when importing the SBOM.

The indirect dependencies for a package may seem fixed for a particular package version that is a direct dependency. However, there are uses cases where some of the transitive dependencies could get intentionally excluded, especially for Java software. Thus my recommendation would be to have this mapping in the product and not in the package itself.

Additional notes
Example data for an SBOM imported into DejaCode and the result after exporting it. Notice that dependencies has turned into a flat list.

Imported SBOM:

Exported SBOM:

Linguagem predominante
Python
Estrelas
52
Forks
30
Merge médio
4h 57min
PRs com merge (30d)
21

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de aboutcode-org/dejacode

Todas as issues de aboutcode-org/dejacode

Issues semelhantes

Mais issues de Python

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.