DependencyTrack / DependencyTrack/dependency-track

Integration with cdxgen server for direct SBoM generation

Open
#2,595 2 comments 2 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Dependency track requires an external tool such as [cdxgen](https://github.com/CycloneDX/cdxgen) to ingest the SBoM. The proposal is to invoke the cdxgen server directly over REST API to generate the SBoM continuously.

Linked issue: https://github.com/DependencyTrack/frontend/issues/442

### Proposed Behavior

cdxgen supports a [server mode](https://github.com/CycloneDX/cdxgen#sbom-server). SBoM could be generated for a git repo or file path over REST.

GitHub repo

```
curl "http://127.0.0.1:9090/sbom?url=https://github.com/HooliCorp/vulnerable-aws-koa-app.git&multiProject=true&type=js"
```

File path

```
curl "http://127.0.0.1:9090/sbom?path=/Volumes/Work/sandbox/vulnerable-aws-koa-app&multiProject=true&type=js"
```

An example docker-compose configuration starts the cdxgen server with dependency track.

https://github.com/AppThreat/dep-scan/blob/master/contrib/dependency-track/docker-compose.yml

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.