Hacktoberfest 2026: as issues que os mantenedores marcaram para outubro, abertas e boas para iniciantes. Ver issues do Hacktoberfest

BUG: DejaCode exported CycloneDX SBOM does not retain dependency relationship

Aberta
  • Algo errado?
#271 3 comentários 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
4/5
Tempo estimado
3-5 dias
Facilidade para iniciantes
35/100
Tipo de issue
Bug
Clareza
Razoavelmente clara
Status de atividade
Estagnada
Stack de tecnologia
python
Domínio
security

Direção de pesquisa

Reproduza o workflow por meio de Actions > Load packages from SBOMs e Share > CycloneDX usando uma SBOM CycloneDX 1.6 com dependências transitivas. Compare o inventário importado e as relações de dependência com as dependências exportadas e revise a issue relacionada #122. Está concluído quando a importação preserva a distinção entre dependências diretas e indiretas e a exportação emite cada pacote com referências dependsOn para suas dependências reais.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

bug design needed enhancement HighPriority td

Describe the bug
Current DejaCode versions already represent the relationships between packages in a product's inventory and their dependencies with other packages. However, when exporting an SBOM that relationship is not correctly represented in the resulting file. This was tested with CycloneDX as output format.

The resulting file list all packages as if they are direct dependencies. This is incorrect, has some may only be transitive dependencies. This is highly important to get right for regulatory purposes as it indicates who is responsible for fixing issues or updating versions. If it is a direct dependency then the organisation developing the product is directly responsible. However, if a dependency of the product has transitive dependencies where a package is outdated, then the organisation developing the product may have to wait for a patch of that dependency to be released. Furthermore, displaying transitive dependencies as direct dependencies is simply inaccurate for the purpose of software component analysis.

To Reproduce

  1. Create a product in DejaCode
  2. Generate an SBOM for a product with a tool such as cdxgen, where there are transitive dependencies
  3. Use "Actions > Load packages from SBOMs" with "Scan all packages of this product post-import" checked
  4. Once the import is completed you should see the inventory populated and dependencies filled
  5. Use "Share > CycloneDX" to export an SBOM in format version 1.6
  6. Open the SBOM in an editor of your choice an see that all packages are listed as direct dependencies under the key "dependencies" and within that "dependsOn".

Expected behavior
Instead of having all packages listed in "dependsOn" as direct dependencies, they should be listed as follow:

  • All dependencies should each have an entry like: 
    {
    "ref": "pkg:pkgmanager/[email protected]",
    "dependsOn": []
},
  • "dependsOn" should reference the PURLs of other packages that they depend on, if any (just like dependencies already do in DejaCode's internal model)

Important: The SBOM import must also ensure that only direct dependencies are listed as packages in the inventory and indirect/transitive dependencies are listed as dependecies. Otherwise this cannot be fixed afterwards. Hence, this issue is related to https://github.com/aboutcode-org/dejacode/issues/122

Screenshots
n.a.

Context (OS, Browser, Device, etc.):
n.a.

Linguagem predominante
Python
Estrelas
52
Forks
30
Merge médio
4h 57min
PRs com merge (30d)
21

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de aboutcode-org/dejacode

Todas as issues de aboutcode-org/dejacode

Issues semelhantes

Mais issues de Python

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.