DependencyTrack / DependencyTrack/dependency-track

Documentation: how to do SBOM autoCreate with a child project

Open
#2,522 3 comments 7 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

It's possible to auto-create a project based on an SBOM upload API call using `autoCreate=true`. This is useful, as it means various projects across an org don't have to all maintain a DT project UUID, and can just push with a consistent name and it Just Works™.

However, if we would like to have a project that has children, so we can group different versions of the same project, we can no longer use this method, and there appears to be no simple combination of API calls that would allow it.

#### Currently, I think this is the only way it could work:
```bash
# Get all projects, filter them by name client-side,
# and get the UUID of the relevant parent project, if it exists, else create it
# and then populate the child project's `parent` field with its UUID
curl https://dt.example.com/v1/project
#

if [ -n "$PARENT_UUID" ]; then
curl -X PUT https://dt.example.com/v1/project -d '{"core": "data" }'
#
fi

curl -X PUT https://dt.example.com/v1/project -d ':"parent": "${PARENT_UUID}", "core": "data"}'
```

### Proposed Behavior

#### Three examples of how it could work:
```bash
# Project autoCreate option on BOM creation can also autocreate a parent based on name, if it doesn't exist
# Otherwise it will add a new child to the existing project
curl -X POST https://dt.example.com/v1/bom -d '{"autoCreateAsChild": true}'
```

```bash
# When creating a project, have an option to autocreate a parent if it doesn't exist, matching on name
curl -X PUT https://dt.example.com/v1/project?autoCreateParent=true -d '{"core": "data" }'
```

```bash
# Add an option to project lookup that ignores version
# So we can get a parent project and, create a new one if necessary, then attach a new child project to it
curl https://dt.example.com/v1/project/lookup?name=My+First+Project
#

if [ -n "$PARENT_UUID" ]; then
curl -X PUT https://dt.example.com/v1/project -d '{"core": "data" }'
#
fi

curl -X PUT https://dt.example.com/v1/project -d ':"parent": "${PARENT_UUID}", "core": "data"}'
```

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.