BUG: DejaCode exported CycloneDX SBOM does not retain dependency relationship
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
调研方向
通过 Actions > Load packages from SBOMs 和 Share > CycloneDX，使用包含传递依赖的 CycloneDX 1.6 SBOM 重现该工作流。将导入的清单和依赖关系与导出的依赖进行比较，并查看相关 issue #122。完成标准是导入保留直接依赖与间接依赖的区别，并且导出为每个包生成指向其实际依赖的 dependsOn 引用。
由索引模型根据 Issue 内容生成。
描述
Describe the bug
Current DejaCode versions already represent the relationships between packages in a product's inventory and their dependencies with other packages. However, when exporting an SBOM that relationship is not correctly represented in the resulting file. This was tested with CycloneDX as output format.
The resulting file list all packages as if they are direct dependencies. This is incorrect, has some may only be transitive dependencies. This is highly important to get right for regulatory purposes as it indicates who is responsible for fixing issues or updating versions. If it is a direct dependency then the organisation developing the product is directly responsible. However, if a dependency of the product has transitive dependencies where a package is outdated, then the organisation developing the product may have to wait for a patch of that dependency to be released. Furthermore, displaying transitive dependencies as direct dependencies is simply inaccurate for the purpose of software component analysis.
To Reproduce
- Create a product in DejaCode
- Generate an SBOM for a product with a tool such as cdxgen, where there are transitive dependencies
- Use "Actions > Load packages from SBOMs" with "Scan all packages of this product post-import" checked
- Once the import is completed you should see the inventory populated and dependencies filled
- Use "Share > CycloneDX" to export an SBOM in format version 1.6
- Open the SBOM in an editor of your choice an see that all packages are listed as direct dependencies under the key "dependencies" and within that "dependsOn".
Expected behavior
Instead of having all packages listed in "dependsOn" as direct dependencies, they should be listed as follow:
- All dependencies should each have an entry like:
{ "ref": "pkg:pkgmanager/[email protected]", "dependsOn": [] }, - "dependsOn" should reference the PURLs of other packages that they depend on, if any (just like dependencies already do in DejaCode's internal model)
Important: The SBOM import must also ensure that only direct dependencies are listed as packages in the inventory and indirect/transitive dependencies are listed as dependecies. Otherwise this cannot be fixed afterwards. Hence, this issue is related to https://github.com/aboutcode-org/dejacode/issues/122
Screenshots
n.a.
Context (OS, Browser, Device, etc.):
n.a.
- 主要语言
- Python
- 星标
- 52
- 派生
- 30
- 平均合并
- 4 小时 57 分钟
- 30 天内合并 PR
- 21
环境准备
- 提供 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
aboutcode-org/dejacode 的其他 Issue
-
documentation
难度 3/5 1-2 天 新手友好度 55/100
aboutcode-org/dejacode#606 ·
维护者通常 1 天内回复
-
难度 4/5 3-5 天 新手友好度 45/100
aboutcode-org/dejacode#603 ·
维护者通常 1 天内回复
-
design needed enhancement
难度 3/5 1-2 天 新手友好度 62/100
aboutcode-org/dejacode#561 · 3 条评论 ·
维护者通常 1 天内回复
-
Enhancement request: Refine License Category - Copyleft Limited可能重新可做 @hesa 于 118 天前认领，目前没有进行中的 PR。 未关闭design needed enhancement
aboutcode-org/dejacode#499 · 13 条评论 · 已指派 3 人 ·
维护者通常 1 天内回复
-
BUG: Product overview page splits product with many versions across pages可能重新可做 关联的 PR 已关闭且未合并。 未关闭bug design needed enhancement
难度 3/5 1-2 天 新手友好度 45/100
aboutcode-org/dejacode#460 ·
维护者通常 1 天内回复
查看 aboutcode-org/dejacode 的全部 Issue
相似的 Issue
-
changelog investigate
难度 2/5 1-3 小时 新手友好度 67/100
ramnes/notion-sdk-py#433 ·
-
docs pkg:core
难度 1/5 1 小时以内 新手友好度 84/100
pydantic/pydantic-ai#11929 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 78/100
intake/intake-esm#789 ·
-
难度 2/5 1-3 小时 新手友好度 82/100
MemMachine/MemMachine#1877 ·
维护者通常 3 天内回复
-
难度 2/5 1-3 小时 新手友好度 68/100
openedx/openedx-authz#579 ·
维护者通常 1 天内回复