CycloneDX / CycloneDX/cyclonedx-cli
Add support for dependency graph visualization
- Dominant language
- C#
- Stars
- 541
- Forks
- 82
- PR merge metrics
- No merged PRs in 30d
Description
When working with dependencies, it's important to understand how they're introduced.
Since CycloneDX 1.2, dependency graphs are part of the core spec. For previous spec versions, there is a [dependency graph extension](https://cyclonedx.org/ext/dependency-graph/).
The graph as included in CycloneDX BOMs is, while simple and minimalistic, hard to parse for humans.
cyclonedx-cli should include a command that visualizes the graph in some sort of tree structure.
For example, executing for `mvn dependency:tree` for [Alpine](https://github.com/stevespringett/Alpine) produces the following output:
```
us.springett:alpine:jar:1.8.0-SNAPSHOT
+- commons-io:commons-io:jar:2.6:compile
+- org.apache.commons:commons-lang3:jar:3.10:compile
+- org.apache.commons:commons-collections4:jar:4.4:compile
+- org.glassfish.jersey.core:jersey-client:jar:2.29.1:compile
| +- jakarta.ws.rs:jakarta.ws.rs-api:jar:2.1.6:compile
| +- org.glassfish.jersey.core:jersey-common:jar:2.29.1:compile
| | +- jakarta.annotation:jakarta.annotation-api:jar:1.3.5:compile
| | +- org.glassfish.hk2:osgi-resource-locator:jar:1.0.3:compile
| | \- com.sun.activation:jakarta.activation:jar:1.2.1:compile
| \- org.glassfish.hk2.external:jakarta.inject:jar:2.6.1:compile
+- javax.servlet:javax.servlet-api:jar:4.0.1:provided
+- org.glassfish.jersey.containers:jersey-container-servlet:jar:2.29.1:compile
| +- org.glassfish.jersey.containers:jersey-container-servlet-core:jar:2.29.1:compile
| \- org.glassfish.jersey.core:jersey-server:jar:2.29.1:compile
| +- org.glassfish.jersey.media:jersey-media-jaxb:jar:2.29.1:compile
| \- jakarta.xml.bind:jakarta.xml.bind-api:jar:2.3.2:compile
| \- jakarta.activation:jakarta.activation-api:jar:1.2.1:compile
...
```
The main focus should be on terminal output. For the future, it may also be helpful to transpile CDX's dependency graph into the [DOT language](https://github.com/vfrz/DotNetGraph), which would allow generation of graph images with [GraphViz](https://graphviz.org/).
Contributor guide
Assessment
This issue has not been assessed yet.