DependencyTrack / DependencyTrack/dependency-track

Load Metadata Component Values like Description, CPE, PURL and Properties into Project

Open
#2,376 1 comment 0 reactions 0 assignees View on GitHub
cdx-1.4 enhancement p2
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Metadata values in the sbom don't get imported.

```
"metadata": {
"component": {
"type": "file",
"name": "ignored",
"description": "text not imported",
"cpe": "cpe:2.3:a:my-project:not-imported-either:1.2.FR:*:*:*:*:*:*:*",
"purl": "pkg:maven/my-project/not-imported-either@1.2.FR",
"pedigree": {
"commits": [ {
"url": "https://myurl"
}
]
},
"properties": [ {
"name": "my-value",
"value": "https://myurl"
}
]
}
},
```

### Proposed Behavior

Description, Properties, CPE, PURL should all be imported into the project if valued.

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.