DependencyTrack / DependencyTrack/dependency-track

Automatically set "Classifier" field from the CPE.

Open
#3,075 0 comments 0 reactions 0 assignees View on GitHub
enhancement p3
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

When adding hardware components to a project, we also have to manually fill out the Classifier which is a mandatory field.

### Proposed Behavior

Since we are already providing the CPE, it seems like the classifier could be parsed from the CPE based on the standard:

```
In the Common Platform Enumeration (CPE) specification, the "Part" component of a CPE string represents the class or category of the product being described. While "o" typically stands for "Operating System," there are several other possible values for the "Part" component, each representing a different class of product. Here are some common values:

a: "Application" - This indicates that the CPE string describes an application or software program. It is used for software products like web browsers, word processors, and other applications.
h: "Hardware" - This value is used for hardware devices or components. It describes physical hardware products such as computer processors, graphics cards, or network routers.
o: "Operating System" - As you mentioned, this value represents an operating system. It is used for CPE strings that describe operating systems like Windows, Linux distributions, or macOS.
g: "Device" - This value is used for general devices that may not fit neatly into the "Hardware" category. It can describe various types of devices, including IoT (Internet of Things) devices.
c: "Operating System Component" - This is used for components or modules within an operating system. For example, it can describe specific libraries or subsystems within an OS.
p: "Application Component" - Similar to "Operating System Component," this value is used for components or modules within an application.
u: "Unknown" - This is used when the class of the product is unknown or not specified.
```
For example, in CPE "cpe:2.3:h:intel:xeon_silver_4116:-:*:*:*:*:*:*:*" the h after the 2nd colon would determine the classifier. It could still be manually overridden for those who need that functionality.

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.