Add SBOM manufacturer during export - #6935
Conversation
Persists manufacturer of imported SBOMs. Adds setting for instance wide default for manufacturer. Export uses either the saved manufacturer of the import or the instance wide default. Signed-off-by: Patrick Schmitt <patrick_98@t-online.de>
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
Up to standards ✅🟢 Issues
|
| /** | ||
| * Resolves the organization that manufactured the BOM document itself | ||
| * (CycloneDX {@code metadata.manufacturer}), as opposed to the manufacturer | ||
| * of the project/subject component described by the BOM. | ||
| * <p> | ||
| * A manufacturer captured from a previously imported BOM for this project | ||
| * takes precedence over the system-wide default configured in Admin > General. | ||
| */ | ||
| private static OrganizationalEntity resolveBomManufacturer(final Project project, final QueryManager qm) { | ||
| if (project != null && project.getMetadata() != null && project.getMetadata().getManufacturer() != null) { | ||
| return project.getMetadata().getManufacturer(); | ||
| } | ||
| return manufacturerFromConfig(qm); | ||
| } |
There was a problem hiding this comment.
Always falling back to a global default is not safe.
This assumes all projects in the portfolio are your own, which in many cases they aren't. For example if you consume BOMs from your vendors, or you monitor other OSS projects, and so on.
Even if all projects were strictly internal, you could still have multiple sub-organizations / departments with different logical business entities, also making a single global default impractical.
Regardless of the global default, import and export of manufacturers data is something we should support. So perhaps it's worth decoupling the two things.
There was a problem hiding this comment.
But does it really matter who owns the project? The manufacturer in question here is the manufacturer of the SBOM itself and not the project/component described by the SBOM. In my opinion a global default makes sense in this case, since whoever operates the DependencyTrack instance is de-facto the manufacturer of all SBOMs exported from it.
Alternatively, I could also make the SBOM manufacturer configurable at a project level, maybe in the Identiy tab. This way individual projects could overwrite the global default, without having to alter the SBOMs they import.
Signed-off-by: Patrick Schmitt <patrick_98@t-online.de>
3 participants
Description
This adds support for the SBOM manufacturer field (author of the SBOM).
If an imported SBOM contains the manufacturer field, it is persisted.
Additionally a new instance setting can be used to provide a default manufacturer, which is used if the imported SBOMs do not contain a manufacturer.
Addressed Issue
fixes #3935
related to #6852
Additional Details
Note that the CycloneDX manufacturer field is only available from v1.6 onward, therefore the manufacturer is not included in the SBOM downloaded via the UI (hardcoded to v1.5).
If requested it would also be possible to enhance this feature with a per-project manufacturer setting, so projects could deviate from the instance default or override the imported SBOM's manufacturer.
Related PRs: DependencyTrack/frontend#1737 DependencyTrack/docs#215
Checklist
- [ ] This PR fixes a defect, and I have provided tests to verify that the fix is effective- [ ] This PR is a substantial change (per the ADR criteria), and I have added an ADR underdocs/adr/