DependencyTrack / DependencyTrack/dependency-track

Improve VEX/VDR features documentation

Open
#2,741 0 comments 1 reaction 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

VEX/VDR are quite useful in CycloneDX capability space. However, the current documentation does not explicitly describe the implementation logic (matching rules, default behaviour) of Dependency Track. This makes implementing VEX/VDR seemingly difficult for users not familiar with DT code base and several issues/discussions being created (few examples below with rules description) :

- https://github.com/DependencyTrack/dependency-track/issues/2596
- https://github.com/DependencyTrack/dependency-track/discussions/1921
- https://github.com/DependencyTrack/dependency-track/discussions/2733
- https://github.com/DependencyTrack/dependency-track/discussions/1961
- https://github.com/DependencyTrack/dependency-track/discussions/1910

### Proposed Behavior

Add a specific page in the documentation with :

- Reference to CycloneDX documentation and examples regarding VEX/VDR
- Explain Dependency Track implementation (c.f linked issues/documentation)
- Highlight limitation with regards to VEX upload
- Provide examples

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.