Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: provide scores in sbom details response #1005

Draft
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

dejanb
Copy link
Contributor

@dejanb dejanb commented Nov 14, 2024

This is the first attempt in resolving #952

Copy link
Member

@carlosthe19916 carlosthe19916 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dejanb thanks for putting this PR in place.

Generally speaking this is exactly what I need so I would be happy to have this PR merged but here are some things I've just notice that we might need to address before:

  • I've uploaded the files from D3 https://github.com/trustification/trustify/tree/main/etc/datasets/ds3
  • Then try to hit the endpoint http://localhost:8080/api/v1/sbom/{id}/advisory and the response is huge. The one I got has 40Mb of size which I think is too much.
    • I guess the size of the response could be explained because the response includes status.vulnerability.advisories where advisories is the field that weights the most. From the top of my mind I would suggest removing status.vulnerability.advisories so the response is not that huge but I am not sure if that is fine with you.

@dejanb
Copy link
Contributor Author

dejanb commented Nov 14, 2024

Yeah, as mentioned in the issue, I think we should actually return VulnerabilitySummary here, but that needs a bit more changes to fetch for a single vulnerability. It should be faster as well as it will not reach database to fetch unnecessary data.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants