Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

Enhancement request: Trigger `populate_purldb` pipeline in ScanCode.io on SBOM import

未关闭
  • 哪里不对？
#306 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
25/100
Issue 类型
功能
描述清晰度
基本清楚
活跃度
停滞
技术栈
python
领域
api, backend, devops

调研方向

首先跟踪 SBOM 导入入口以及名为 load_sbom 和 populate_purldb 的 pipeline；先验证 ScanCode.io 依赖问题 #1644。然后梳理 web/API 选项、PurlDB 完成、Improve Packages from PurlDB 以及后续扫描流程。配置的导入能够在无需手动操作 ScanCode.io 的情况下完成这些步骤，即视为完成。

由索引模型根据 Issue 内容生成。

描述

design needed enhancement

Is your enhancement request related to a problem? Please describe.
Currently DejaCode has trouble getting all necessary information for scanning package that have been imported from SBOMs. Most often not enough information are present to deduce the download URL. For references, see issues such as:

The issue stems from the fact the translation from PURL to URL is not always directly possible and may thus not be supported by purl2url and/or DejaCode is not using purl2url in all situations (it is used when manually adding a package but seemingly not when importing through SBOM). For example more elaborate logic is needed for Maven to determine what file needs to be downloaded, which may not be immediately clear from the PURL as the file could have a variety of potential file extensions. This issue can be addressed by using DejaCode, ScanCode.io, and PurlDB, where PurlDB is pulling the metadata of the package, which can then be used to enhance the package information in DejaCode.

Currently the step of gathering metadata for an SBOM requires manually creating an additional pipeline in ScanCode.io to run populate_purldb for the imported SBOM. My suggestion would be to offer an additional option for the SBOM import so that DejaCode triggers this pipeline automatically after running load_sbom. In a completely perfect solution, DejaCode would also allow to run "Improve Package from PurlDB" automatically, once PurlDB has concluded the gathering of metadata. This is needed to assign the download URLs to the package, otherwise the scanning of packages cannot be started

Note: For this to work, ScanCode.io first has to fix the bug in https://github.com/aboutcode-org/scancode.io/issues/1644 where populate_purldb fails if any dependencies are listed in the SBOM. This currently requires to manually edit the SBOM file and remove the dependencies array in the JSON file.

What are the benefits of the requested enhancement?

  • Users can import SBOM and have packages analyzed straight from DejaCode, without requiring additional manual steps or access to ScanCode.io
  • Allows fully automated CI/CD integration, where a product is created, SBOM uploads, metadata gathered and then all packages get scanned

Describe the solution you would like

  • Extend the project that is being created in ScanCode.io by a populate_purldb pipeline after the load_sbom pipeline
  • Run "Improve Packages from PurlDB" once the PurlDB has gather the metadata (unclear if this is technically possible)
  • Once the metadata has been added to the packages continue with scanning the packages
  • Provide options in the web view and API to configure if these two options should be enabled for an SBOM import

Additional notes
This feature together with the fix for ScanCode.io would greatly help to integrate this an automated CI workflow.

主要语言
Python
星标
52
派生
30
平均合并
4 小时 57 分钟
30 天内合并 PR
21

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

aboutcode-org/dejacode 的其他 Issue

查看 aboutcode-org/dejacode 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。