Component properties not present in downloaded BOM

[muxmuse]

Current Behavior

The downloaded BOM (file) doesn't include component properties that were present in a former upload.

Steps to Reproduce

1. Create a new project
2. In the components tab, upload a CycloneDX file with at least one component with properties
3. Download the BOM and search for the properties

mve

{
  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.4",
  "version": 1,
  "serialNumber": "urn:uuid:5dd1cf22-47a8-4c0c-ac0e-f58eb356dbcb",
  "components": [
    {
      "type": "library",
      "name": "build-angular",
      "group": "@angular-devkit",
      "version": "16.1.0",
      "bom-ref": "@angular-devkit/[email protected]",
      "purl": "pkg:npm/%40angular-devkit/[email protected]",
      "properties": [
        {
          "name": "cdx:npm:package:path",
          "value": "node_modules/@angular-devkit/build-angular"
        },
        {
          "name": "cdx:npm:package:development",
          "value": "true"
        }
      ]
    }
  ]
}

Expected Behavior

Uploaded component properties exist in downloaded BOM file.

Dependency-Track Version

4.8.2

Dependency-Track Distribution

Container Image

Database Server

H2

Database Server Version

No response

Browser

Mozilla Firefox

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this defect was already reported

[angegar]

The author information are not there too.

[setchy]

We observed the same issue last week.

It looks like a subset of the component specification model is converted and persisted in

dependency-track/src/main/java/org/dependencytrack/parser/cyclonedx/util/ModelConverter.java

Line 157 in 9ad07b5

public static Component convertComponent(final org.cyclonedx.model.Component cdxComponent) {

Items that are currently omitted include component properties, component evidence, etc

[nscuro]

The properties part is being worked on here: #3499

As for the evidence, it is not imported because there is not a clear story yet as to what to actually do with it. Importing data for the sake of importing it is not something we want to do. The way how that information is stored has to work well with how it's going to be queried / used.

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.