DependencyTrack / DependencyTrack/dependency-track
Integration with cdxgen server for direct SBoM generation
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
Dependency track requires an external tool such as [cdxgen](https://github.com/CycloneDX/cdxgen) to ingest the SBoM. The proposal is to invoke the cdxgen server directly over REST API to generate the SBoM continuously.
Linked issue: https://github.com/DependencyTrack/frontend/issues/442
### Proposed Behavior
cdxgen supports a [server mode](https://github.com/CycloneDX/cdxgen#sbom-server). SBoM could be generated for a git repo or file path over REST.
GitHub repo
```
curl "http://127.0.0.1:9090/sbom?url=https://github.com/HooliCorp/vulnerable-aws-koa-app.git&multiProject=true&type=js"
```
File path
```
curl "http://127.0.0.1:9090/sbom?path=/Volumes/Work/sandbox/vulnerable-aws-koa-app&multiProject=true&type=js"
```
An example docker-compose configuration starts the cdxgen server with dependency track.
https://github.com/AppThreat/dep-scan/blob/master/contrib/dependency-track/docker-compose.yml
### Checklist
- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested
Contributor guide
Assessment
This issue has not been assessed yet.