DependencyTrack / DependencyTrack/dependency-track

Allow filtering for internal components in SBOM export

Open
#3,106 2 comments 1 reaction 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Currently when doing an SBOM Export all project components are included in the export.

However DT has an attribute of components identifying them as being internal.

In some contexts it makes most sense to exclude such components from the SBOM.
E.g. when providing the SBOM for OSS component License Validation by the legal department.
In other contexts where the SBOM is intended to declare OSS components and not list any vendor proprietary components.

### Proposed Behavior

We suggest that a variant of the SBOM export function is added where the SBOM does not include the components marked Internal.

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.