CycloneDX / CycloneDX/cyclonedx-cli

Add support for dependency graph visualization

Open
#4 11 comments 3 reactions 0 assignees View on GitHub
enhancement
Dominant language
C#
Stars
541
Forks
82
PR merge metrics
No merged PRs in 30d

Description

When working with dependencies, it's important to understand how they're introduced.
Since CycloneDX 1.2, dependency graphs are part of the core spec. For previous spec versions, there is a [dependency graph extension](https://cyclonedx.org/ext/dependency-graph/).

The graph as included in CycloneDX BOMs is, while simple and minimalistic, hard to parse for humans.
cyclonedx-cli should include a command that visualizes the graph in some sort of tree structure.

For example, executing for `mvn dependency:tree` for [Alpine](https://github.com/stevespringett/Alpine) produces the following output:

```
us.springett:alpine:jar:1.8.0-SNAPSHOT
+- commons-io:commons-io:jar:2.6:compile
+- org.apache.commons:commons-lang3:jar:3.10:compile
+- org.apache.commons:commons-collections4:jar:4.4:compile
+- org.glassfish.jersey.core:jersey-client:jar:2.29.1:compile
| +- jakarta.ws.rs:jakarta.ws.rs-api:jar:2.1.6:compile
| +- org.glassfish.jersey.core:jersey-common:jar:2.29.1:compile
| | +- jakarta.annotation:jakarta.annotation-api:jar:1.3.5:compile
| | +- org.glassfish.hk2:osgi-resource-locator:jar:1.0.3:compile
| | \- com.sun.activation:jakarta.activation:jar:1.2.1:compile
| \- org.glassfish.hk2.external:jakarta.inject:jar:2.6.1:compile
+- javax.servlet:javax.servlet-api:jar:4.0.1:provided
+- org.glassfish.jersey.containers:jersey-container-servlet:jar:2.29.1:compile
| +- org.glassfish.jersey.containers:jersey-container-servlet-core:jar:2.29.1:compile
| \- org.glassfish.jersey.core:jersey-server:jar:2.29.1:compile
| +- org.glassfish.jersey.media:jersey-media-jaxb:jar:2.29.1:compile
| \- jakarta.xml.bind:jakarta.xml.bind-api:jar:2.3.2:compile
| \- jakarta.activation:jakarta.activation-api:jar:1.2.1:compile
...
```

The main focus should be on terminal output. For the future, it may also be helpful to transpile CDX's dependency graph into the [DOT language](https://github.com/vfrz/DotNetGraph), which would allow generation of graph images with [GraphViz](https://graphviz.org/).

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.