DependencyTrack / DependencyTrack/dependency-track
Project autocreation leads to multiple projects
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
In our gitlab pipelines we provide a template that sends via trivy generated sboms to our DependencyTrack instance. In our REST request to ```/api/v1/bom``` we provide the parameters:
```
autoCreate=true
projectName=myProjectName
projectVersion=1.0.0
```
This will successfully upload the bom and create the project and version.
Now from a subsequent pipeline with a new bom and parameters like these:
```
autoCreate=true
projectName=myProjectName
projectVersion=1.0.1
```
We would expect to add this sbom to the same project.
However, we currently land in a state where it seems only partially linked.
- Projects will be visible multiple times in the project list, and have unique project UUIDs, at least in visible URL like https://dependencytrack/projects/UUID will differ
- However when clicking on one of the projects, the version dropdown correctly shows all available versions
I checked the REST endpoint if there could be more things supplied to give DependencyTrack more "hints", as gitlab would offer more things to match projects, but besides an actual project UUID (which I don't have when relying on autocreation if it doesn't exist) and tags, I can't seem to set things that I could set via UI.
From gitlab perspective, we could easily supply:
- namespace/group/vendor in DT could be the gitlab project part like groupname/subgroup/projectname
- packageurl could be the gitlab project url
- SWID Tag ID could be the gitlab project id
### Steps to Reproduce
1. without an existing project, upload sbom via ```/api/v1/bom``` with these parameters (new project + new version)
```
autoCreate=true
projectName=myProjectName
projectVersion=1.0.0
```
2. with the existing project, upload sbom via ```/api/v1/bom``` with these parameters (existing project + new version)
```
autoCreate=true
projectName=myProjectName
projectVersion=1.0.1
```
### Expected Behavior
Subsequent sbom uploads with autoCreate=on should only create a new project if it is actually a new project.
### Dependency-Track Version
4.13.4
### Dependency-Track Distribution
Container Image
### Database Server
H2
### Database Server Version
_No response_
### Browser
Google Chrome
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.