Add relationships between dependencies

[Nowcide]

Hi @Jasper-Ben,

I see you're working hard on the CycloneDX recipe and wanted to know if you'd like to add the relationships. Indeed, to comply with NTIA and other regulations, they are sometimes necessary.

I'm researching how to add them, which must be possible since the initial SPDX recipe has them. Have you ever wondered about this?

[Jasper-Ben]

Hi @Nowcide,

I have indeed thought about it and it would be a nice improvement, however I currently do not plan on working on that. I might be wrong, but I think that would blow up the complexity quite a bit. Feel free to look into it though! 🙂

Any improvements into this directions should be tested against DependencyTrack though, as this is the de facto standard tool for managing CycloneDX SBOMs in a meaningful matter. At least the way the spdx class in yocto reflects relationships by generating hundreds of SPDX files (currently) seems quite useless to me if you actually want to work with the results. So if we have to decide between relationship information and actual usefulness of the SBOM for CVE tracking, I will make the pragmatic decision to keep the SBOM as is

[Nowcide]

Thank you for your answer. So, I will be working on this soon. I'll let you know if I get anything suitable.

[Nowcide]

Hi @Jasper-Ben,

I hope you're well.

I've managed to generate the relationships between the dependencies without increasing the complexity of the code too much.

However, I was wondering about the component search. On a project, when I compare the components found by spdx and cyclonedx on the same build, I notice that sbom spdx generates many more components.

Do you know if this could be due to the tool/how dependencies are retrieved with the cyclonedx layer or if it could be due to a difference in granularity between the two formats?

[Jasper-Ben]

Hi @Nowcide,

However, I was wondering about the component search. On a project, when I compare the components found by spdx and cyclonedx on the same build, I notice that sbom spdx generates many more components.

Do you know if this could be due to the tool/how dependencies are retrieved with the cyclonedx layer or if it could be due to a difference in granularity between the two formats?

There are differences to be expected. On the one hand because the spdx class follows a more fine-granular (and complex) approach, on the other hand this is also due to their respective use-cases. I would not see the meta-cyclonedx class as a replacement for the spdx class, but rather as an extension:

From my experience, spdx works well for license compliance, while cyclonedx works well for vulnerability tracking.