DependencyTrack / DependencyTrack/dependency-track

Compare one DT Project with Another

Open
#3,057 2 comments 2 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

In Dependency-Track v4.8.2, one can have two projects that are nominally the same (ie, the project owners *think* that they should report identical results) but the projects are obviously NOT the same...

* Different risk score totals even though nothing is suppressed in either project
* Same total number of suppressions in each project... but are they for the same vulns?
* Different number of suppressions in each project... ditto but also more confusing.
* etc

The problem is that it is hard to work out what might be causing discrepencies

### Proposed Behavior

Implement functionality that will allow two projects to be compared with each other:

* Differences in components
* Differences in component versions
* Differences in identified vulnerabilities
* Differences in suppressions

Extension of the basic idea might also report differences in configured alerts, policies, etc.

When BOM Repository Server is implemented in DT, then it should also be possible to compare BOMs. ie, BOM upload today to project X with BOM uploaded 3 months ago to same project.

Aside: differences in identified vulnerabilities can occur in several ways. For instance, a BOM uploaded in 2022 might have a `sonatype-xxx` vulnerability. Uploading the exact same BOM to a new project today will NOT have that vulnerability (as it no longer exists in OSS Index).

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.