DependencyTrack / DependencyTrack/dependency-track

BOM validation soft failing

Open
#3,795 5 comments 3 reactions 1 assignee Claimed by @chseaamtueerl View on GitHub
enhancement good first issue hacktoberfest p3 size/S
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Currently, you either disable BOM validation, or you enable it. Which either results in no validation or possibly many failures right now.

### Proposed Behavior

Add another state "soft validation" which
1) Does enable validation
2) On failure:
2a) Logs validation failure with details
2b) sends out notification of validation failed (see https://github.com/DependencyTrack/dependency-track/issues/3778)
2c) Possibly gives feedback in return of API call
3) But: DOES NOT FAIL the import, and still returns API status 200 OK.

This would allow the monitoring of imports for a while, to ensure all used tools behave properly. Due to usage of many tools in different projects and different circumstances in different projects it would be beneficial to first observe the behaviour for some weeks before letting uploads faile. Furthermore it might give a hint in the logs if a validation failed AND later the processing failed. This might help identifying processing issues.

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.