DependencyTrack / DependencyTrack/dependency-track

DT should expose history of BOM uploads into a project during its lifetime (REST API, UI)

Open
#4,294 0 comments 2 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

As raised during issue #4284 discussion in Slack, currently (4.12) DT does not provide information about how many times, or when, new iterations of SBOM documents were uploaded into a project. This information is in fact available as part of `BOM` tables (and similarly in `VEX`).

> @nscuro : The data already exists in the BOM and VEX tables, and it includes stuff like format, spec version, serial number, and when it was uploaded. That data is not really exposed as such though, neither via frontend, nor via API. There's some cool stuff we could do with it though, including enrichment of the metrics graph with indicators when a BOM was uploaded, or rendering an "event history" log that lists all the imported docs. <...> since it’s not exposed anywhere currently there’s little benefit.

This issue is logged to not only expose the already available information, but also to keep a reminder in line with goals of issue #4284 to replicate such information when a project is cloned - an option (probably a separate one) to replicate such rows as part of project-cloning, to attach (a copy of) pre-history to new PROJECT_ID vs. starting from scratch at the moment of cloning (and/or a subsequent BOM upload).

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.