What is the "Services" project tab there for?

[fabiante]

Hey 👋🏻

In the project view, there is a services tab, which is always empty on my projects.
Example URL: /projects/8d9871ac-496e-4965-83a9-3017e1639ccf/services

In the docs i only find explainers about how to use DT for managing multiple services, but that seems like non-related.

Is that tab actually used at the moment (v5)?

[darekwojciechowski]

It's used, it's just fed from something almost nothing generates. CycloneDX has a top-level services array, separate from components, for external services your app calls. That tab renders those and nothing else. No services in your BOM means an empty tab, permanently.

It's a different thing from the docs page you found about managing multiple services in DT, which is about how you organise projects. Easy to conflate.

The reason it's always empty in practice: dependency scanners don't emit services. Syft, cdxgen and the language-specific tools all walk your dependency tree, and dependencies are components. Services are something you declare by hand or add in a post-processing step, because no tool can infer "this app talks to Stripe" from a lockfile.

Drop this into a BOM and upload it if you want to see the tab populate:

"services": [
  {
    "bom-ref": "stripe-api",
    "name": "Stripe API",
    "endpoints": ["https://api.stripe.com"],
    "authenticated": true,
    "x-trust-boundary": true
  }
]

Those four fields are exactly what DT stores per service, so they'll all show up in the UI.

[fabiante]

Thanks for the explainer!