Add missing support for supplier and manufacturer

[stevespringett]

Current Behavior

DT does not support supplier on the component or supplier and manufacturer at the metadata level. This is an oversight as OrganizationalEntity.java was created for this purpose and is used by CycloneDX service to support providers. But OrganizationalEntity was never added to the BOM or component objects.

Proposed Behavior

Add support for supplier on the component and supplier and manufacturer at the BOM metadata level.

Considering this is an NTIA minimum requirement, this needs to be added asap.

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this enhancement was already requested

[stevespringett]

Related to #2373

[leec94]

is this completed now with the merged PR? @nscuro

[nscuro]

Hey @leec94, I found a few wrinkles while dabbling around locally:

1. As per CDX spec, components have only suppliers, but no manufacturers. The current implementation has both assigned to Project and Component, but manufacturer can never be populated for those.
2. metadata.manufacture and metadata.supplier in the spec map to Bom#manufacture and Bom#supplier respectively. The current implementation however assigns metadata.manufacture to Project#manufacture, and metadata.component.supplier and metadata.supplier are ignored entirely.
3. We need changes in the frontend to display this information. ComponentDetailsModal and ProjectDetailsModal must be extended with a Supplier tab. We have something similar for service providers in ServiceDetailsModal already.

I raised #3179 with some initial work for (1) and (2).

Another more general complication I'm seeing: If metadata.manufacturer and metadata.supplier map to the Bom model in DT, then how should DT behave when exporting a project as CycloneDX again?

The relationship between Bom and Project in DT is N:1, and because projects can be edited manually there is no guarantee that the last uploaded BOM still represents reality. Also, binding these attributes to Bom means that users will never be able to manually craft manufacturer and supplier data in DT, without having uploaded a BOM before.

@stevespringett, any thoughts? I think we may need a new table to track this kind of metadata (PROJECT_METADATA?). That table would then also hold things like tools, lifecycle, authors, etc. in the future.

[nscuro]

Ah, found this #2373 (comment):

These things could also be asserted in a BOM and we should likely store them somewhere related to the project, but also lock them so that they cannot be modified.

I think that answers my question. So separate table it is.

[nscuro]

OK I may have gotten it wrong again.

It seems like metadata.manufacturer would indeed map to Project#manufacturer. But metadata.supplier would be something separate from Project, because there's already metadata.component.supplier that maps to Project#supplier.

So something along the lines of:

For reference, I asked about these fields in the #specification CycloneDX Slack channel: https://cyclonedx.slack.com/archives/CVA0G10FN/p1699447821448959

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.