Repository: DependencyTrack/dependency-track

Issue #3923: DT resets some (but not all) of my updated components
Created: 2024-07-05T11:49:04Z
Current Behavior
Some of the components in our projects don't have their license set, so we set those manually to fulfill our companies policies. However, after running another import, the licenses in some of our components get reset, whereas others are not. We are not sure if this happens to other fields as well, since we only set the license. We do see that if it happens, it always happens to the same components!
We can also say this happens with licenses from the 'official' SPDX list (so no manual licenses, but I can't say this might not also be affected by this issue) --> in our case it's a couple of MITs and Apache-2.0s.

Steps to Reproduce
I hope the problem is actually reproducible and not happening (partially) random:

Upload this SBOM
Edit the licenses for (in our case):


is-invalid-path 0.1.0
is-valid-path 0.1.1
requireg 0.2.2
valid-url 1.0.9


We wait for DT to actually show these changes in the policies (we need to wait till the next day, can this be somehow forced?)
Check that the licenses are still there
Upload a the SBOM again
Check that the licenses are not set anymore (this runs during the night, so we are not sure if this is instantly or not -- haven't been able to test this 'live')

Expected Behavior
Our components keep the changes that are made and our policies are therefore not violated.
Dependency-Track Version
4.11.4
Dependency-Track Distribution
Container Image
Database Server
PostgreSQL
Database Server Version
14.9
Browser
Mozilla Firefox
Checklist

 I have read and understand the contributing guidelines
 I have checked the existing issues for whether this defect was already reported

Duplicate issue #3950: License Information gets lost after a new analysis
Created: 2024-07-09T06:13:12Z
Current Behavior
We have a simple tooling running next to Dependency Track, which reacts on the "BOM_PROCESSED" webhook, and based on that interacts with the REST API of Dependency Track to add more metadata towards Dependency Track.
One of the key points we do here is the following: if Dependency Track was unable to resolve the license information for a certain dependency, we query an internal database were we mapped these dependencies towards their effective license and update the license information accordingly inside Dependency Track.
This works flawlessly. We can clearly see after the process has been executed that the components which did not have license information now have license information and that the components which did not resolve their license info properly have now a resolved license.
I would have expected that this metadata remains after a new import, unless there is some license info coming from the SBOM that overrules it.
However, what I see is undeterministic behaviour.
An example is the com.google.guava dependency, we use v33.2.1-jre of it. Dependency Track does not resolve our SBOM import towards a license, leaving the component without license info at all.
Our sidecar tooling will automatically annotate it again properly.
However, on the next SBOM import it becomes random (without code change for project which generates the SBOM), one run Dependency Track keeps the annotated data, another run it clears it again.
This is not really a problem, but since there is no way to trigger the policy evaluation again, we get wrong information in our policy violations.
Steps to Reproduce
These steps will probably not work in each case, since it is a non-consistent behaviour.


Import an SBOM which refers to a component which does not have license information. E.g. com.google.guava, as in this one 3bdbb654-da0c-479d-8c05-c3170f3cced0-inventory.cdx.json


After the SBOM is processed, update the metadata of the license from the Dependency Track GUI so that it is a resolved license.


Import the same SBOM again.


Sometimes the license info will be cleared, sometimes it will be kept.
Expected Behavior
Annotated metadata should remain, unless it is provided externally. I.e. if there is no license information in the SBOM, the license information should not be cleared out.
Dependency-Track Version
4.11.3
Dependency-Track Distribution
Container Image
Database Server
PostgreSQL
Database Server Version
No response
Browser
Google Chrome
Checklist

 I have read and understand the contributing guidelines
 I have checked the existing issues for whether this defect was already reported

Closing comment (2024-07-09T06:14:02Z): Sorry, duplicate of #3923