DependencyTrack / DependencyTrack/dependency-track
Automatically set "Classifier" field from the CPE.
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
When adding hardware components to a project, we also have to manually fill out the Classifier which is a mandatory field.
### Proposed Behavior
Since we are already providing the CPE, it seems like the classifier could be parsed from the CPE based on the standard:
```
In the Common Platform Enumeration (CPE) specification, the "Part" component of a CPE string represents the class or category of the product being described. While "o" typically stands for "Operating System," there are several other possible values for the "Part" component, each representing a different class of product. Here are some common values:
a: "Application" - This indicates that the CPE string describes an application or software program. It is used for software products like web browsers, word processors, and other applications.
h: "Hardware" - This value is used for hardware devices or components. It describes physical hardware products such as computer processors, graphics cards, or network routers.
o: "Operating System" - As you mentioned, this value represents an operating system. It is used for CPE strings that describe operating systems like Windows, Linux distributions, or macOS.
g: "Device" - This value is used for general devices that may not fit neatly into the "Hardware" category. It can describe various types of devices, including IoT (Internet of Things) devices.
c: "Operating System Component" - This is used for components or modules within an operating system. For example, it can describe specific libraries or subsystems within an OS.
p: "Application Component" - Similar to "Operating System Component," this value is used for components or modules within an application.
u: "Unknown" - This is used when the class of the product is unknown or not specified.
```
For example, in CPE "cpe:2.3:h:intel:xeon_silver_4116:-:*:*:*:*:*:*:*" the h after the 2nd colon would determine the classifier. It could still be manually overridden for those who need that functionality.
### Checklist
- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested
Contributor guide
Assessment
This issue has not been assessed yet.