DependencyTrack / DependencyTrack/dependency-track
Add "Hash of all the hashes" to speed up processing bom in Dependency Track
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
Cross-issue with https://github.com/CycloneDX/specification/issues/118
### The problem
Consider that you have big amount of services (thousands) which are processed in Dependency Track during CI/CD daily. It is not necessary that the list of components for that services also changes everyday. In such configuration DTrack will make a work to simply try to determine if there are new components in every sbom upload.
### Proposed solution
Dtrack can gather hashes of the all components in the uploaded bom and generates the new one to compare against "last uploaded sbom hash for the project". It should be a fast operation without multiple database queries.
Contributor guide
Assessment
This issue has not been assessed yet.