DependencyTrack / DependencyTrack/dependency-track
DT should expose history of BOM uploads into a project during its lifetime (REST API, UI)
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
As raised during issue #4284 discussion in Slack, currently (4.12) DT does not provide information about how many times, or when, new iterations of SBOM documents were uploaded into a project. This information is in fact available as part of `BOM` tables (and similarly in `VEX`).
> @nscuro : The data already exists in the BOM and VEX tables, and it includes stuff like format, spec version, serial number, and when it was uploaded. That data is not really exposed as such though, neither via frontend, nor via API. There's some cool stuff we could do with it though, including enrichment of the metrics graph with indicators when a BOM was uploaded, or rendering an "event history" log that lists all the imported docs. <...> since it’s not exposed anywhere currently there’s little benefit.
This issue is logged to not only expose the already available information, but also to keep a reminder in line with goals of issue #4284 to replicate such information when a project is cloned - an option (probably a separate one) to replicate such rows as part of project-cloning, to attach (a copy of) pre-history to new PROJECT_ID vs. starting from scratch at the moment of cloning (and/or a subsequent BOM upload).
Contributor guide
Assessment
This issue has not been assessed yet.