DependencyTrack / DependencyTrack/dependency-track

Add "Hash of all the hashes" to speed up processing bom in Dependency Track

Open
#1,326 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

Cross-issue with https://github.com/CycloneDX/specification/issues/118

### The problem
Consider that you have big amount of services (thousands) which are processed in Dependency Track during CI/CD daily. It is not necessary that the list of components for that services also changes everyday. In such configuration DTrack will make a work to simply try to determine if there are new components in every sbom upload.

### Proposed solution
Dtrack can gather hashes of the all components in the uploaded bom and generates the new one to compare against "last uploaded sbom hash for the project". It should be a fast operation without multiple database queries.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.