search

microsoft / sbom-tool

The SBOM tool is a highly scalable and enterprise ready tool to create SPDX 2.2 compatible SBOMs for any variety of artifacts.
MIT License
1.63k stars 133 forks source link

Add dependency graph support to remaining ecosystems #754

Closed jalkire closed 1 month ago

jalkire commented 1 month ago

This PR builds off of #746 to add support for ancestral dependencies of the remaining ecosystems supported by CD. The list of ecosystems supporting graph creation can be found here.

codecov-commenter commented 1 month ago

Codecov Report

Attention: Patch coverage is 60.00000% with 2 lines in your changes missing coverage. Please review.

Project coverage is 70.13%. Comparing base (4e682e6) to head (ae1b1d4). Report is 1 commits behind head on main.

Files with missing lines Patch % Lines
...pters/ComponentDetection/PodComponentExtensions.cs 0.00% 1 Missing :warning:
.../ComponentDetection/RubyGemsComponentExtensions.cs 0.00% 1 Missing :warning:
Additional details and impacted files ```diff @@ Coverage Diff @@ ## main #754 +/- ## ========================================== - Coverage 70.13% 70.13% -0.01% ========================================== Files 277 277 Lines 8646 8651 +5 Branches 1006 1006 ========================================== + Hits 6064 6067 +3 - Misses 2063 2065 +2 Partials 519 519 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

jalkire commented 1 month ago

Are there any concerns caused by a diamond pattern? For instance, if my app has direct dependencies on package X and package Y, and those packages each have a direct dependency on package Z, does package Z get included as a dependency of both X and Y, or either X or Y ?

That's a good question! As it stands in this and the previous PR, the latter would occur (either X or Y). We primarily care about differentiating between direct and indirect dependencies, but I will double check if the both X and Y behavior is preferable.