Support for DVC import dependencies

[sisp]

I'd like to be able to generate SBOM for local projects which have data dependencies managed via DVC. DVC is a popular project in the machine learning (ML) community which, among other things, manages data via Git (similar to Git LFS) and supports importing data from other Git repos (similar to Git submodules) in which case a .dvc file with a dependency entry is created. The main use case for data imports is the decoupling of data (typically ML datasets for training and testing) and ML projects (ML algorithms trained and tested on datasets) by managing data in data registries and importing them in ML projects. The data in these data registries should have a license under whose terms it may be used and, thus, it would be beneficial to include this information in the SBOM.

Would you be open to receiving a contribution to Trivy (and the go-dep-parser library) that adds support for .dvc files with dependency entries?

[nejch]

This is somewhat related to #3067 and all the related draft PRs, feel free to chime in there @sisp :)

[sisp]

Thanks, @nejch! 👍

[github-actions]

This issue is stale because it has been labeled with inactivity.