DependencyTrack / DependencyTrack/dependency-track
Policy: Add support for BOM in policy conditions
Open
enhancement
needs milestone
on hold
p2
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
Extend functionality implemented in #83 to support BOM (CycloneDX, SPDX, spec versions, signed/unsigned, etc) in policy conditions.
Contributor guide
Research direction
Start by reading issue #83 and tracing the existing policy-condition support it introduced. Determine how BOM metadata such as CycloneDX and SPDX formats, specification versions, and signed or unsigned status should be represented in policy conditions; done means the requested BOM variants are supported consistently.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100