DependencyTrack / DependencyTrack/dependency-track

Parent project name is not respected

Open
#5,586 2 comments 0 reactions 0 assignees View on GitHub
defect in triage
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

To keep track of deployed containers we created namespaces as parent projects (e.g. `deptrack-dev` and `deptrack-prd`). Namespaces can contain multiple projects - which are containers running inside the namespace (e.g. `dependencytrack/apiserver`, `dependencytrack/frontend`, `aquasec/trivy`). The container version is used as project version, the container name (including registry) is used as project name. For example one of the containers for service Dependency-Track and its version is `dependencytrack/apiserver:4.13.6`. The generated SBOM (`deptrack_apiserver.json`) for this specific container is uploaded with settings:

```shell
curl -X "POST" "https://dependency-track/api/v1/bom" \
-H 'Content-Type: multipart/form-data' \
-H "X-Api-Key: XXX" \
-F "autoCreate=true" \
-F "projectName=deptrack-apiserver" \
-F "projectVersion=4.13.6" \
-F "parentName=deptrack-dev" \
-F "parentVersion=parent" \
-F "classifier=Container" \
-F "updateParent=true" \
-F "isLatest=true" \
-F "bom=@deptrack_apiserver.json"

```

We want to organize containers (projects) in namespaces to know where they are running and which team is responsible. Running container versions can differ at some point in time. A new version is first deployed in DEV namepace (`deptrack-dev`) and later in PRD namespace (`deptrack-prd`). The SBOMs for containers are automatically generated in a CI/CD pipeline and uploaded to Depedency-Track when a new version of a container is deployed.

The issue is that parent project name is not respected. If you first upload the SBOM with `projectName=deptrack-apiserver`, `projectVersion=4.13.6` and `parentName=deptrack-dev` It will correctly show under `deptrack-dev`. Next - when you want to deploy the same container and version to production - you use the same SBOM with `projectName=deptrack-apiserver`, `projectVersion=4.13.6` and `parentName=deptrack-prd`. Now the project doesn't show under `deptrack-prd` but overwrites the entry (updated Last BOM import) in `deptrack-dev`.

### Steps to Reproduce

1. create projects `deptrack-dev` and `deptrack-prd` both with version `parent` to reflect namespaces for DEV and PRD
2. generate the SBOM for a specific container: `trivy image --format cyclonedx --skip-db-update --skip-check-update --output deptrack_apiserver.json dependencytrack/apiserver:4.13.6`
3. upload the SBOM file to DEV namespace `deptrack-dev`:
```shell
curl -X "POST" "https://dependency-track/api/v1/bom" \
-H 'Content-Type: multipart/form-data' \
-H "X-Api-Key: XXX" \
-F "autoCreate=true" \
-F "projectName=deptrack-apiserver" \
-F "projectVersion=4.13.6" \
-F "parentName=deptrack-dev" \
-F "parentVersion=parent" \
-F "classifier=Container" \
-F "updateParent=true" \
-F "isLatest=true" \
-F "bom=@deptrack_apiserver.json"
```
4. Project `dependencytrack/apiserver:4.13.6` will show under `deptrack-dev`
5. Next, upload the SBOM file to PRD namespace `deptrack-prd`:
```shell
curl -X "POST" "https://dependency-track/api/v1/bom" \
-H 'Content-Type: multipart/form-data' \
-H "X-Api-Key: XXX" \
-F "autoCreate=true" \
-F "projectName=deptrack-apiserver" \
-F "projectVersion=4.13.6" \
-F "parentName=deptrack-prd" \
-F "parentVersion=parent" \
-F "classifier=Container" \
-F "updateParent=true" \
-F "isLatest=true" \
-F "bom=@deptrack_apiserver.json"
```
6. Notice there is no project `dependencytrack/apiserver:4.13.6` created under `deptrack-prd`, but the project `dependencytrack/apiserver:4.13.6` under `deptrack-dev` is updated - the last BOM import timestamp has been updated.

### Expected Behavior

The expected behaviour is to respect the parent project name. If an SBOM is uploaded with identical `projectName` and `projectVersion`, but different `parentName` I would expect there would be two project entries, each under their own `parentName`.

### Dependency-Track Version

4.13.6

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

17.4

### Browser

Mozilla Firefox

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.