DependencyTrack / DependencyTrack/dependency-track
BOM validation soft failing
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
Currently, you either disable BOM validation, or you enable it. Which either results in no validation or possibly many failures right now.
### Proposed Behavior
Add another state "soft validation" which
1) Does enable validation
2) On failure:
2a) Logs validation failure with details
2b) sends out notification of validation failed (see https://github.com/DependencyTrack/dependency-track/issues/3778)
2c) Possibly gives feedback in return of API call
3) But: DOES NOT FAIL the import, and still returns API status 200 OK.
This would allow the monitoring of imports for a while, to ensure all used tools behave properly. Due to usage of many tools in different projects and different circumstances in different projects it would be beneficial to first observe the behaviour for some weeks before letting uploads faile. Furthermore it might give a hint in the logs if a validation failed AND later the processing failed. This might help identifying processing issues.
### Checklist
- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested
Contributor guide
Assessment
This issue has not been assessed yet.