DependencyTrack / DependencyTrack/dependency-track
Compare one DT Project with Another
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
In Dependency-Track v4.8.2, one can have two projects that are nominally the same (ie, the project owners *think* that they should report identical results) but the projects are obviously NOT the same...
* Different risk score totals even though nothing is suppressed in either project
* Same total number of suppressions in each project... but are they for the same vulns?
* Different number of suppressions in each project... ditto but also more confusing.
* etc
The problem is that it is hard to work out what might be causing discrepencies
### Proposed Behavior
Implement functionality that will allow two projects to be compared with each other:
* Differences in components
* Differences in component versions
* Differences in identified vulnerabilities
* Differences in suppressions
Extension of the basic idea might also report differences in configured alerts, policies, etc.
When BOM Repository Server is implemented in DT, then it should also be possible to compare BOMs. ie, BOM upload today to project X with BOM uploaded 3 months ago to same project.
Aside: differences in identified vulnerabilities can occur in several ways. For instance, a BOM uploaded in 2022 might have a `sonatype-xxx` vulnerability. Uploading the exact same BOM to a new project today will NOT have that vulnerability (as it no longer exists in OSS Index).
### Checklist
- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested
Contributor guide
Assessment
This issue has not been assessed yet.