DependencyTrack / DependencyTrack/frontend

Accept repo url for direct sbom generation with cdxgen server

Open
#442 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Vue
Stars
171
Forks
250
Avg merge
11h 12m
Merged PRs (30d)
82

Description

### Current Behavior

Dependency track requires an external tool such as [cdxgen](https://github.com/CycloneDX/cdxgen) to ingest the SBoM. The proposal is to add input fields in the UI to accept the repo URL and authentication information and enable the backend service to invoke the cdxgen server directly over REST API to generate the SBoM continuously.

Will create a separate ticket to enhance the backend service and link it with this.

### Proposed Behavior

cdxgen supports a [server mode](https://github.com/CycloneDX/cdxgen#sbom-server). SBoM could be generated for a git repo or file path over REST.

GitHub repo

```
curl "http://127.0.0.1:9090/sbom?url=https://github.com/HooliCorp/vulnerable-aws-koa-app.git&multiProject=true&type=js"
```

File path

```
curl "http://127.0.0.1:9090/sbom?path=/Volumes/Work/sandbox/vulnerable-aws-koa-app&multiProject=true&type=js"
```

An example docker-compose configuration starts the cdxgen server with dependency track.

https://github.com/AppThreat/dep-scan/blob/master/contrib/dependency-track/docker-compose.yml

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/frontend/issues) for whether this enhancement was already requested

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.