DRAFT: Issue #2737 - Fulfil NTIA minimum requirements

[melba-lopez]

Description

Addressed Issue

#2737

Additional Details

Checklist

• I have read and understand the contributing guidelines
• This PR fixes a defect, and I have provided tests to verify that the fix is effective
• This PR implements an enhancement, and I have provided tests to verify that it works as intended
• This PR introduces changes to the database model, and I have added corresponding update logic
• This PR introduces new or alters existing behavior, and I have updated the documentation accordingly

[nscuro]

Hey @melba-lopez, added some comments to the changes made so far.

So far you've covered supplier data in metadata.component of the BOM, which corresponds to a project's supplier in DT.

For the component side of things in DT, you want to look at these methods:

• Convert from CycloneDX to DT:

  dependency-track/src/main/java/org/dependencytrack/parser/cyclonedx/util/ModelConverter.java

  Line 98 in 561ef18

  public static Component convert(final QueryManager qm, final org.cyclonedx.model.Component cycloneDxComponent, final Project project) {

• Convert from DT to CycloneDX again:

  dependency-track/src/main/java/org/dependencytrack/parser/cyclonedx/util/ModelConverter.java

  Line 209 in 561ef18

  public static org.cyclonedx.model.Component convert(final QueryManager qm, final Component component) {

Happy to help if you need more clarification or get stuck!

[nscuro]

createMetadata is converting from DT's data model to CycloneDX, so it should not set anything on DT's project:

Suggested change

	project.setSupplier(supplier);
	cycloneComponent.setSupplier(supplier);

[melba-lopez]

made the change. will commit shortly :)

[melba-lopez]

when i make this change it is complaining for some reason 😭

[melba-lopez]

Thanks for all the feedback @nscuro def will take all the help i can get :) hopefully i can finally start fixing this tomorrow evening.

[melba-lopez]

@nscuro i made all the changes and had to fix/undo some changes i made accidentally. not sure why it does not like your recommendation cycloneComponent.setSupplier(supplier);

[nscuro]

This was taken over by @leec94 in #3090. Thanks @melba-lopez for your work on this! :)