Description
Feature request
Some vulnerabilities are only present if a dependency is brought in directly exposed by direct dependency. In some cases, the vulnerability does not exist if the dependency is a transitive of another dependency. If the SBOM contains dependency references and the hierarchy, then this can be calculated.
The current SBOM generation has a flat structure and does not contain the dependency hierarchy.
The solution could be: -
Either: generic/default with --enable-sbom optional flag, adding the hierarchical feature
Or: add an optional parameter --enable-sbom=cyclondx,strict,hierarchical
This will benefit security checking systems post-build to eliminate false positive security vulnerabilities
The alternative would require generating the hierarchial sbom at build time, however, given the optimasations that go on in the native-image tooling, it is more optimal within this process.