Repository navigation
DJC: Provide new command option on Product to "Improve Packages from latest data" #45
Description
Importing an SBOM into a DejaCode Product can be disappointing if the SBOM does not have much license information. A nice feature would be to provide a new command option to "Improve Packages from PurlDB" on the Product "Scan" dropdown:
Step through the Product Packages
Use the PURL to find an entry in the PurlDB
Apply PurlDB field values to empty fields in the Product Package and corresponding Package definitions.
Reacted by Robert
Activity
DennisClark commentedon Apr 1, 2024
Given our recent experience with importing real-world SBOMs into DejaCode with rather scant license information, I think we should raise the priority on this one.
Skip the PURL fields in update_from_data #45
Add support for generic keywords in PackageAddView.get_initial #45
Add update_from_purldb method on the Package model #45
Add an improve_packages_from_purldb method and view #45
Merge main and fix conflicts #45
Fix failing tests #45
Run the improve_packages_from_purldb as async task #45
Turn off mark_all_notifications_as_read for Product #45
DennisClark commentedon Jul 10, 2024
@tdruez when I click on the notification generated by the "Improve..." process, it takes me to the Product (good) but it is not marking the notification as Read, and it continues to show up in the list.
The basic functionality of the "Improve..." process appears to be working fine, although I am still testing that.
DennisClark commentedon Jul 10, 2024
@tdruez if possible, it might be better that when I click on the notification, it would open the Product positioned on the History tab rather than the Essentials tab.
[-]Provide new command option to "Improve Packages from PurlDB" on Product "Scan" dropdown [/-][+]Provide new command option on Product to "Improve Packages from latest data"[/+]DennisClark commentedon Jul 18, 2024
Let's expand this enhancement to include checking the DejaCode Package definitions for updates since a Package was initially assigned to a Product; this can be especially useful if the Package was scanned after it was assigned to the Product, such as from the "Scan all Packages" action. The primary field of interest here would be the license_expression on the Product Package, so that if that field is empty it would be eligible for refreshing from an updated Package.
[-]Provide new command option on Product to "Improve Packages from latest data"[/-][+]DJC: Provide new command option on Product to "Improve Packages from latest data"[/+]Fix failing tests #45
Proper display of the improve_packages_from_purldb link #45
Add unit tests #45
Display overlay when triggering the "Improve" action #45
Provide feedback on the "Improve" action through the import system #45
Add a "Improve Packages from PurlDB" action in the Product details view
tdruez commentedon Sep 2, 2024
@DennisClark The #135 PR has been refined, merged, and deployed.
The "Improve" action is now logged in the "Import" tab of the Product details view, so you can track the progress there and get the list of "Improved" packages directly from that tab.
Feel free to close this one or to let me know about any possible improvements.
DennisClark commentedon Sep 3, 2024
@tdruez The logging of the Improve action on the Imports tab looks good, thanks. I think we can close this one.