CycloneDX / CycloneDX/specification
Support for dependency graph to better represent Software Heritage and OmniBOR ADG
- Dominant language
- XSLT
- Stars
- 547
- Forks
- 93
- Avg merge
- 7h 11m
- Merged PRs (30d)
- 37
Description
Currently, dependencies is an array supporting two kinds of relationships - dependsOn (for dependency trees) and provides (for implementations). Both Software Heritage and OmniBOR supports [advanced](https://docs.softwareheritage.org/devel/swh-graph/api.html) [graphs](https://omnibor.io/glossary/artifact_dependency_graph/) that requires representing the nodes and edges of a graph in a raw form to support advanced queries such as identifying "neighbours" or tracking custom relationship between two blobs.
Access to such precise graph is necessary to unlock the next level of supply-chain analysis to operate at a granular blob level rather than at a component purl level.
Contributor guide
Assessment
This issue has not been assessed yet.