search

DependencyTrack / dependency-track

Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.
https://dependencytrack.org/
Apache License 2.0
2.45k stars 532 forks source link

Support of Spring Boot SBOM actuator endpoint #3751

Open sbklahr opened 1 month ago

sbklahr commented 1 month ago

Current Behavior

Dependency-Track consumes and analyzes CycloneDX BOMs usually as part of a CI/CD pipeline.

Proposed Behavior

Spring Boot 3.3.0 introduced a SBOM actuator endpoint that exposes SBOMs of running applications.

It would be beneficial to analyze SBOMs of running applications in Dependency Track without a build pipeline. Actuator endpoints could be specified in the "Create Project"/"Project Details" dialogue along with authentication parameters and polling frequency.

Checklist