Skip to content
Permalink

Comparing changes

This is a direct comparison between two commits made in this repository or its related repositories. View the default comparison for this range or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: guacsec/trustify
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: 313aeaa9e8c97d46cc26340834acf812ed565883
Choose a base ref
..
head repository: guacsec/trustify
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: 192dc365d6ed5711ce4839f4743fe5a79a3efbee
Choose a head ref
Showing with 32 additions and 4 deletions.
  1. +32 −2 docs/adrs/00002-analysis-graph.md
  2. +0 −1 docs/adrs/00002-conceptual-model.svg
  3. +0 −1 docs/adrs/00002-graph-relations-capture.svg
34 changes: 32 additions & 2 deletions docs/adrs/00002-analysis-graph.md
Original file line number Diff line number Diff line change
@@ -14,7 +14,22 @@ relationships we capture and the view we want to create from the forest of graph
Ingesting an sbom captures a set of trustify relationships, which are instantiated
in the forest of graphs as;

![Graph relations capture](00002-graph-relations-capture.svg)
```mermaid
graph TD
PackageA -->|CONTAINS| PackageOther
PackageD -->|CONTAINED_BY| PackageA
PackageA -->|DEPENDS_ON| PackageB
PackageB -->|DEPENDENCY_OF| PackageA
SBOMDOC1 -->|DESCRIBES| PackageA
UpstreamComponent -->|ANCESTOR_OF| PackageA
image.arch1 -->|VARIANT_OF| ImageIndex1
image.arch2 -->|VARIANT_OF| ImageIndex1
SBOMDOC2 -->|DESCRIBES| ImageIndex1
SBOMDOC3 -->|DESCRIBES| srpm_component
binarycomponent1 -->|GENERATED_FROM| srpm_component
binarycomponent2 -->|GENERATED_FROM| srpm_component
```

Trustify relationships attempt to put an abstraction over relationships
defined by any format of sbom (eg. cyclonedx, spdx).
@@ -28,7 +43,22 @@ overload that model to serve as conceptual model.
The `api/v2/analysis` endpoints are responsible for building up the conceptual view. Where we want to query, filter and
traverse on the following.

![Conceptual model](00002-conceptual-model.svg)
```mermaid
graph TD
SBOMDOC1 -->|DESCRIBES| PackageA
PackageA -->|CONTAINS| PackageOther
PackageA -->|CONTAINS| PackageD
PackageA -->|DEPENDS| PackageB
SBOMDOC2 -->|DESCRIBES| ImageIndex1
UpstreamComponent -->|ANCESTOR_OF| PackageA
ImageIndex1 -->|VARIANT| image.arch1
ImageIndex1 -->|VARIANT| image.arch2
SBOMDOC3 -->|DESCRIBES| srpm_component
srpm_component -->|GENERATES| binarycomponent1
srpm_component -->|GENERATES| binarycomponent2
```

It is a feature that this conceptual model spans beyond traversal of just transitive software dependencies.

1 change: 0 additions & 1 deletion docs/adrs/00002-conceptual-model.svg

This file was deleted.

1 change: 0 additions & 1 deletion docs/adrs/00002-graph-relations-capture.svg

This file was deleted.