DJC: Enhance DejaCode models to support relating dependencies to packages

[pombredanne]

Derived from:

• RFC: Design improved relationships for Package, Dependencies, Embeds and Requirements  scancode.io#1066

[rogu-beta]

• Do you have a rough timeframe until when you plan to complete this?
• Is my understanding correct, that once this is implemented, the foundation is laid for modelling transitive dependencies (Enhancement request: Retain transitive relationship between packages when importing SBOM #122). It would then be possible to implement an updated SBOM import that retains the hierarchy and exported SBOMs of a project could include them as well.

[tdruez]

Do you have a rough timeframe until when you plan to complete this?

Now that the new Dependency architecture is complete and stable on the ScanCode.io side, we'll be discussing the design and the DejaCode implementation in the next few days. We should have a better estimate then.

It would then be possible to implement an updated SBOM import that retains the hierarchy and exported SBOMs of a project could include them as well.

Yes, that's the goal, the full "Product" hierarchy would be importable and exportable.

[rogu-beta]

That is fantastic news! Thank you for all the hard work you put into your software. I'm looking forward to testing the new features as soon as they are available.