DependencyTrack / DependencyTrack/dependency-track

CBOM support

Open
#6,191 3 comments 5 reactions 0 assignees View on GitHub
enhancement p2 size/L
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Cyclonedx 1.6 supports CBOMs. CBOMs cannot be processed by DT yet since components of type crypto asset and contained data (crypto properties) are not supported. This requires changes in both hyades-apiserver and hyades-frontend.
The idea is to enable DT in a first step to process and render CBOM data, and in a second step to add an integration to a CBOM repository which would allow enriching SBOMs with crypto information on contained packages.

### Proposed Behavior

Enable DT to read, persist, export and render CBOM data.

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/hyades/blob/main/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/hyades/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.