Audit history is sometimes lost when cloning project

[jensborrmann]

Current Behavior

For some of our projects cloning including everything (in particular audit history) has various issues. Unfortunately, these

1. Depend on the existing project: I was not able to hunt down the criteria.

2. Differ: What I saw was
   a) Lost audits:
   In some cases all, in others most of the audit analyses where lost.

b) Changes in number of components:
In some cases many components seem to have been duplicated so that they are twice in the resulting project version.

Additional information:

1. The server log files did not exhibit any suspicious deviations.
2. We observed similar behaviour when interacting with the REST API in our CI/CD pipelines.
3. I was not able to reproduce the issues with the following experiment
   a) Export BOM from a "malicious" project A
   b) Create a new project B using the exported BOM
   c) Clone B

Steps to Reproduce

1. Find a project that is (for whatever reason) problematic
2. Clone including "everything" (audit history, ...)
3. Go to the overview of the newly created project version

Expected Behavior

a) Equal audit state: All audits should be applied to the cloned version. The number of unaudited issues should be the same as in the original version.
b) Stability regarding components: The same number and content of components should be found in the clone version.

Do you have any idea/suggestions?
Is there a realistic chance that an update to 4.7 would change our situation?

Dependency-Track Version

4.6.x

Dependency-Track Distribution

Container Image

Database Server

PostgreSQL

Database Server Version

12

Browser

N/A

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this defect was already reported

[jensborrmann]

demo_original.txt
demo_copy.txt

I attached the before/after BOMs for a case in which the audit history was lost. Things do not really look suspicious to me. But maybe an educated observer will find something of interest.

[nscuro]

We're tracking this in #2875.

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.