DependencyTrack / DependencyTrack/frontend
Accept repo url for direct sbom generation with cdxgen server
- Dominant language
- Vue
- Stars
- 171
- Forks
- 250
- Avg merge
- 11h 12m
- Merged PRs (30d)
- 82
Description
### Current Behavior
Dependency track requires an external tool such as [cdxgen](https://github.com/CycloneDX/cdxgen) to ingest the SBoM. The proposal is to add input fields in the UI to accept the repo URL and authentication information and enable the backend service to invoke the cdxgen server directly over REST API to generate the SBoM continuously.
Will create a separate ticket to enhance the backend service and link it with this.
### Proposed Behavior
cdxgen supports a [server mode](https://github.com/CycloneDX/cdxgen#sbom-server). SBoM could be generated for a git repo or file path over REST.
GitHub repo
```
curl "http://127.0.0.1:9090/sbom?url=https://github.com/HooliCorp/vulnerable-aws-koa-app.git&multiProject=true&type=js"
```
File path
```
curl "http://127.0.0.1:9090/sbom?path=/Volumes/Work/sandbox/vulnerable-aws-koa-app&multiProject=true&type=js"
```
An example docker-compose configuration starts the cdxgen server with dependency track.
https://github.com/AppThreat/dep-scan/blob/master/contrib/dependency-track/docker-compose.yml
### Checklist
- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/frontend/issues) for whether this enhancement was already requested
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.