Additional fields under "Component Details"

[jackstuard]

Current Behavior:

The current view at "Component Details" doesn't contain important fields that can be extracted under the bom.xml file like: external references (website, vcs, distribution, issue-tracker), and also publisher information.

Proposed Behavior:

Add adicional fields when uploading bom.xml: external references (website, vcs, distribution, issue-tracker), and also publisher information. Author also should be nice to have but will be hard to extract as it doesn't contain under bom.xml file.

[msymons]

This would be very useful functionality. In fact, I could have sworn that I requested the same a while back but cannot find it!

I would want to ensure that projects themselves in Dependency Track also use such links, but perhaps only in the form "Only use the links from BOM if not manually configured in DT".

Specifically...

• Links from DT projects to the right URL important because we have multiple Jenkins Servers. I would use such a link all the time... "project X not updated in DT for a week, let me click link and go and see what happened".
• Links to issue tracking useful because, sad to say, sometimes project names in issue tracking do not match how they are known elsewhere (or vice versa). Links to issue tracking could also be extended to provide integration with auditing (raise issues, etc)?
• Naming issue also crops up in vcs repos!

[stevespringett]

The first step is documenting what the external references are. There are about 15 or so different types that are supported by the standard. The UI and underlying database will need to be able to support all types. Once this ticket is implemented, then a future enhancement would be to display these links in various parts of the app depending on what type of external references are available.

[jackstuard]

The first step is documenting what the external references are. There are about 15 or so different types that are supported by the standard.

Hummm.. where to document do you mean? The spec has something already no: https://github.com/CycloneDX/specification/blob/92ea506eb52db831f651d6f6be6b9ff014a93340/schema/bom-1.2.xsd#L676

[stevespringett]

Apologies for the confusion. Let me rephrase... The first step is to support all external reference types that CycloneDX supports.

[stevespringett]

External References were introduced in v4.2.0 for services. Todo: support needs to be added for components

[stevespringett]

Will be available in 4.4.0

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.