DependencyTrack / DependencyTrack/dependency-track

Projects should support multiple artifacts

Open
#6,190 0 comments 1 reaction 0 assignees View on GitHub
enhancement p2 size/XL spike / research
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Currently, a project in Dependency-Track roughly resembles a *single* [Bill of Materials](https://cyclonedx.org/specification/overview/).

This can be limiting in the following ways:

* Some projects consist of multiple parts, and as a consequence of multiple BOMs. For example, a project may have an [HBOM](https://cyclonedx.org/capabilities/hbom/) for hardware components, one or more [SBOM](https://cyclonedx.org/capabilities/sbom/)s for software running on that hardware, and one or more [SaaSBOM](https://cyclonedx.org/capabilities/saasbom/)s that describe service components. A [CBOM](https://cyclonedx.org/capabilities/cbom/) may be added to describe cryptographic algorithms. It is not practical to create separate projects for all of these. Merging them prior to uploading them to DT is possible, but complex.
* Users currently (ab-) use project hierarchies to represent such structures. This is more complex to manage, and not necessarily how we intended hierarchies to be used.
* Supplementary artifacts such as [VEX](https://cyclonedx.org/capabilities/vex/) and [attestations](https://cyclonedx.org/capabilities/attestations/) can never represent projects on their own, by design. But users may still want to upload and track them.
* The upcoming [transparency exchange API](https://github.com/CycloneDX/transparency-exchange-api/) supports many more artifacts than just SBOMs. Currently, DT would only support a small subset of them.

### Proposed Behavior

Enable projects to ingest and track multiple artifacts.

The solution should work with DependencyTrack/dependency-track#6188, such that artifacts are bound to project *versions*.

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/hyades/blob/main/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/hyades/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.