CycloneDX / CycloneDX/specification

Support for dependency graph to better represent Software Heritage and OmniBOR ADG

Open
#440 0 comments 0 reactions 0 assignees View on GitHub
proposed core enhancement
Dominant language
XSLT
Stars
547
Forks
93
Avg merge
7h 11m
Merged PRs (30d)
37

Description

Currently, dependencies is an array supporting two kinds of relationships - dependsOn (for dependency trees) and provides (for implementations). Both Software Heritage and OmniBOR supports [advanced](https://docs.softwareheritage.org/devel/swh-graph/api.html) [graphs](https://omnibor.io/glossary/artifact_dependency_graph/) that requires representing the nodes and edges of a graph in a raw form to support advanced queries such as identifying "neighbours" or tracking custom relationship between two blobs.

Access to such precise graph is necessary to unlock the next level of supply-chain analysis to operate at a granular blob level rather than at a component purl level.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.