DependencyTrack / DependencyTrack/dependency-track

Uploading same SBOM to a different project in Dependency Track fails

Open
#3,402 2 comments 2 reactions 0 assignees View on GitHub
defect pending more information
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Hello,

This is the setup we are currently using.

We have an application SBOM that we're trying to upload to two different projects on Dependency Track, with the same version e.g. SNAPSHOT. Publishing SBOMs of application:SNAPSHOT is working as expected on PROJECT1:SNAPSHOT, but when we try to upload the same application:SNAPSHOT to PROJECT2:SNAPSHOT, the setup doesn't fail, but the application that gets updated is on the PROJECT1:SNAPSHOT directory.

We are using curl to upload same SBOM to two different projects with the same version.

Regards,
Marjan

### Steps to Reproduce

1. Generate application SBOM with version SNAPSHOT
2. Create a project1 with version SNAPSHOT on dependency track
3. Create a project 2 with version SNAPSHOT on DT
4. Upload application SBOM to project1 SNAPSHOT
5. Check the changes
6. Upload application SBOM to project2 SNAPSHOT
7. Check the changes

### Expected Behavior

Both project1 and project2 should contain application SNAPSHOT.

### Dependency-Track Version

4.10.1

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

Mozilla Firefox

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.