DependencyTrack / DependencyTrack/dependency-track
Improve VEX/VDR features documentation
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
VEX/VDR are quite useful in CycloneDX capability space. However, the current documentation does not explicitly describe the implementation logic (matching rules, default behaviour) of Dependency Track. This makes implementing VEX/VDR seemingly difficult for users not familiar with DT code base and several issues/discussions being created (few examples below with rules description) :
- https://github.com/DependencyTrack/dependency-track/issues/2596
- https://github.com/DependencyTrack/dependency-track/discussions/1921
- https://github.com/DependencyTrack/dependency-track/discussions/2733
- https://github.com/DependencyTrack/dependency-track/discussions/1961
- https://github.com/DependencyTrack/dependency-track/discussions/1910
### Proposed Behavior
Add a specific page in the documentation with :
- Reference to CycloneDX documentation and examples regarding VEX/VDR
- Explain Dependency Track implementation (c.f linked issues/documentation)
- Highlight limitation with regards to VEX upload
- Provide examples
### Checklist
- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested
Contributor guide
Assessment
This issue has not been assessed yet.