Identify feature gaps with vanilla Dependency-Track

[nscuro]

We refactored and restructured a lot of things in the API server to make it work with Hyades.

It is possible that by doing this we removed or broke certain features (currently: policy evaluation is not happening).

This macro issue is for identifying more of those gaps and documenting them.

Areas to investigate

• Vulnerability analysis after BOM upload
• Policy evaluation after BOM upload
• Recurring daily vulnerability analysis
• Recurring policy evaluation
• Metrics calculation
• Repository meta analysis
• Vulnerability mirroring
• Notification publishing
  • Test with actual external services (MS Teams)
• ...

Known Gaps

• Only supports PostgreSQL for now, will need to support MSSQL and MySQL as well
  • Issue raised: Support Microsoft SQL Server and MySQL in addition to PostgreSQL #642
• NEW_VULNERABLE_DEPENDENCY notification doesn't work
  • Issue raised: Re-implement support for NEW_VULNERABLE_DEPENDENCY notifications #643
• Policy evaluation is not triggered
  • Re-implemented
• Completion of repository meta analysis can not be tracked
  • Support for this in upstream is rudimentary and currently not used, but will be needed for some use cases in the future
  • Issue raised: Implement tracking for completion of repository metadata analysis #644
• Mirroring and ad-hoc vulnerability analysis with VulnDB is not implemented
  • Issue raised: Implement VulnDB scanner #286
• Mirroring of GitHub Advisories is not yet implemented
  • Re-implemented
• BOM_CONSUMED, BOM_PROCESSED, VEX_CONSUMED, and VEX_PROCESSED notifications do not contain the original CycloneDX BOM / VEX
  • Due to size limitations of Kafka events; BOMs and VEXes can be arbitrarily large
  • Once we integrate with BOM repo server we can link to it (Externalize BOM ingestion pipeline #633)
  • Issue raised: Find a way to include original BOMs (or references to them) in notifications #646
• Fuzzy analysis with internal analyzer doesn't work
  • The feature relies on Lucene indexes, which the vulnerability analyzer does not have access to
  • Issue raised: Re-implement fuzzy analysis for internal scanner #645
• Jira notifications don't work (Port Jira notification publisher from upstream #424)

[nscuro]

We have raised issues to track all items we identified so far. Closing this meta issue.