From 8fe4a86a8bb7af0b4b6d1545aefbca6d498f7fd2 Mon Sep 17 00:00:00 2001 From: Patrick Schmitt Date: Mon, 10 Aug 2026 14:59:36 +0200 Subject: [PATCH] Document new BOM manufacturer setting Also clarifies version of exported BOM and project vs BOM manufacturer Signed-off-by: Patrick Schmitt --- docs/concepts/projects.md | 5 +- docs/guides/administration/.pages | 1 + .../configuring-bom-manufacturer.md | 51 +++++++++++++++++++ docs/reference/file-formats.md | 23 +++++++++ 4 files changed, 79 insertions(+), 1 deletion(-) create mode 100644 docs/guides/administration/configuring-bom-manufacturer.md diff --git a/docs/concepts/projects.md b/docs/concepts/projects.md index 8297d5ef..7e818009 100644 --- a/docs/concepts/projects.md +++ b/docs/concepts/projects.md @@ -18,7 +18,10 @@ Each project has: [classifier list](../reference/projects.md#classifiers). - Optional ecosystem identifiers: a Package URL, a CPE, or a SWID tag. - Descriptive metadata such as a group, a description, authors, a supplier, a manufacturer, - and external references. + and external references. A project's manufacturer describes who makes the software the + project represents, which differs from the + [BOM manufacturer](../reference/file-formats.md#bom-manufacturer) that identifies who + produced the BOM document. - Tags (categorical labels) and project properties (typed key-value metadata). - An optional parent, forming a hierarchy. - An access list controlling which teams can see it. diff --git a/docs/guides/administration/.pages b/docs/guides/administration/.pages index 10608b04..a2b1479d 100644 --- a/docs/guides/administration/.pages +++ b/docs/guides/administration/.pages @@ -10,6 +10,7 @@ nav: - configuring-http-proxy.md - configuring-timezone.md - configuring-banner.md + - configuring-bom-manufacturer.md - configuring-vulnerability-sources.md - running-air-gapped.md - configuring-observability.md diff --git a/docs/guides/administration/configuring-bom-manufacturer.md b/docs/guides/administration/configuring-bom-manufacturer.md new file mode 100644 index 00000000..0a80f1d9 --- /dev/null +++ b/docs/guides/administration/configuring-bom-manufacturer.md @@ -0,0 +1,51 @@ +# Configuring the BOM manufacturer + +Dependency-Track can record the organization that produces the BOMs it generates. +This guide covers how administrators configure that organization for the whole instance. + +## Overview + +CycloneDX documents generated by Dependency-Track can identify their producer in the +`metadata.manufacturer` entry. + +Configure the instance-wide manufacturer from the administration UI under +**Administration → Configuration → General** (route `/admin/configuration/general`). + +!!! note + Access to the general configuration requires the `SYSTEM_CONFIGURATION` + permission. + +## Settings + +The **BOM Manufacturer** section exposes the following fields: + +| Setting | Description | +| --- | --- | +| **Name** | Name of the organization that produces the BOMs. | +| **URL** | Website of the organization. | +| **Contact name** | Name of the contact within the organization. | +| **Contact email** | The contact's email address. | + +All four fields are optional. Leaving them empty removes the instance-wide fallback, so +only projects that carry their own manufacturer keep the entry in their generated +documents. + +## Configuring the manufacturer + +1. Open **Administration → Configuration → General**. +2. Enter the organization details in the **BOM Manufacturer** fields. +3. Select **Update** to save. + +The values apply to every project that does not supply its own manufacturer. + +## Project-specific manufacturers + +When an uploaded BOM records a manufacturer of its own, Dependency-Track stores that value +with the project and uses it for that project's exports, in place of the instance-wide +setting. Every other project falls back to the instance-wide setting. See +[BOM manufacturer](../../reference/file-formats.md#bom-manufacturer). + +!!! note + CycloneDX added `metadata.manufacturer` in version 1.6, and generated documents use + CycloneDX 1.5 by default. Request version 1.6 or later when exporting to include the + manufacturer entry. See [Output version](../../reference/file-formats.md#output-version). diff --git a/docs/reference/file-formats.md b/docs/reference/file-formats.md index d65edab6..f7ea0a53 100644 --- a/docs/reference/file-formats.md +++ b/docs/reference/file-formats.md @@ -23,6 +23,29 @@ Dependency-Track also **generates** CycloneDX documents in several forms: | VEX | A Vulnerability Exploitability Exchange document containing analysis decisions (states, justifications) for a project's findings. | | VDR | A Vulnerability Disclosure Report containing full vulnerability data for a project's components. | +### Output version + +Generated documents use CycloneDX 1.5 by default. The `version` query parameter of the +export endpoints selects a different version of the specification. + +### BOM manufacturer + +Generated documents can carry a `metadata.manufacturer` entry identifying the organization +that produced the BOM. Dependency-Track takes the first value available from: + +1. The manufacturer recorded in the project's most recently imported BOM. +2. The instance-wide manufacturer under **Administration → Configuration → General**, + described in + [Configuring the BOM manufacturer](../guides/administration/configuring-bom-manufacturer.md). + +Documents omit the entry when neither holds a value. + +CycloneDX added `metadata.manufacturer` in version 1.6. Documents generated in earlier +versions of the specification omit the entry, including the 1.5 default. + +The BOM manufacturer is distinct from the manufacturer of the project itself, which +describes the subject of the BOM rather than its producer. + ## Finding Packaging Format (FPF) The Finding Packaging Format (FPF) is a Dependency-Track-native JSON format for