DependencyTrack / DependencyTrack/dependency-track

an REST API which can be used to identifying SBOMs and manage SBOMS using Projects and Versions

Open
#2,415 1 comment 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

We have a use case of storing only a controlled number of versions for the images of our current installation.
to do this I need to be able to identify the SBOMs using project and versions via the API.

Managing the project configuration via the REST api is simply not working.
and I found enough issues from various people who hit a wall as well.

At this point i am quite convinced that there is a serious design flaw in the data model regarding Identity of the involved objects.
the interaction between the index and the relational database looks faulty.

Since the focus is more on presentation i fully understand how this could have happened.
I assume that there are no tests to verify identity within the system.

so this is an attempt to raise focus on this issue as this seems to be not just a bug but something more severe.

my 2 cents

### Proposed Behavior

have an API i can use to manage the objects in the system

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.