dejacode
dejacode copied to clipboard
aboutcode-org
Automate open source license compliance and ensure software supply chain integrity
Adding the Package available at https://github.com/facebook/sapling/archive/refs/tags/0.2.20240718-145624+f4e9df48.tar.gz to DejaCode is generally successful, but there is a problem with the Inferred URL: Package URL: pkg:github/facebook/[email protected]%20f4e9df48 Filename: sapling-0.2.20240718-145624-f4e9df48.tar.gz Download URL: https://github.com/facebook/sapling/archive/refs/tags/0.2.20240718-145624+f4e9df48.tar.gz Inferred URL:...
The attached file dejacode_nexb_product_dejacode_5.2.spdx.json was generated by SCIO and it fails to validate at https://tools.spdx.org/app/validate/ See screenshot.
## Extracted from https://github.com/aboutcode-org/dejacode/issues/295#issuecomment-2824782627 > Running "Improve Package from PurlDB" fails with duplicate key value violates unique constraint"component_catalog_packag_dataspace_id_type_namesp_c6620419_uniq"DETAIL:Key(dataspace_id,type,namespace,name,version,qualifiers,subpath,download_url,filename)=(3,npm,,parse-json,4.0.0,,,https://registry.npmjs.org/parse-json/-/parse-json-4.0.0.tgz,parse-json-4.0.0.tgz)alreadyexists. since assigning the download_url would make it a fully duplicate package. >...
**Describe the bug** Working with DejaCode in a build of https://github.com/aboutcode-org/dejacode/commit/925d4045897da9d7b3de98b8ff3eda3c75b6833d I noticed that several Python package where not being assigned download URLs when using "Improve Package from PurlDB". The...
**Is your enhancement request related to a problem? Please describe.** Currently DejaCode has trouble getting all necessary information for scanning package that have been imported from SBOMs. Most often not...
**Is your enhancement request related to a problem? Please describe.** Currently ScanCode.io already provides information in its scan results, if it finds them, such as: - `homepage_url` - `bug_tracking_url` -...
**Describe the bug** When DejaCode is tasked with analyzing an SBOM it roughly performs two steps: 1. Create a `load_sbom` pipeline in ScanCode.io and import the packages into the inventory...
As the volume of Packages and Package Versions is rapidly increasing, the value of a DejaCode Component as a summary record for packages increases accordingly - both as a summary...
**Describe the bug** When importing a particular SBOM created with cdxgen, the `load_sbom` pipeline succeeds according to ScanCode.io, but DejaCode reports issues importing the dependencies. The error message states: `The...
Metadata
Owner
Metadata
Automate open source license compliance and ensure software supply chain integrity