Fix for package dependency bug #1101
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
/azp run |
|
/azp run |
|
/azp run |
1 similar comment
|
/azp run |
|
This PR changes files in the API project. Does it change any of the API interfaces in any way? Please note that this includes the following types of changes:
Because any of these changes can potentially break a downstream consumer with customized interface implementations, these changes need to be treated as breaking changes. Please do one of the following: Option 1 - Publish this as a breaking change
Option 2 - Refactor the changes to be non-breaking
|
|
/azp run |
pragnya17
commented
Jun 17, 2025
DaveTryon
approved these changes
Jun 17, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR aims to fix a bug that affects SBOM accuracy and determinism during generation. The bug's impact means that all the SBOMs we have been generating since this PR () was merged are not fully representative of the build drop path and are not deterministic. We are discarding a large proportion of our transitive dependency information, and the transitive dependencies that are selected for inclusion may vary between SBOM creations for the same drop.
The root cause was that the package info created from the component detection results was incorrect. We were only getting the FirstOrDefault() AncestralReferrer for each package, which was not deterministic and did not consider the case of multiple referrers.
This PR gets all the package dependencies from the component detection results and translates them correctly into package dependency relationships in the SBOM.