Work towards new API from ADR 00002-analysis-graph

[ctron]

This is a rather large set of changes ... mostly related to implementing recommendations from docs/adrs/00002-analysis-graph

Where we normalise all directional relationships from

graph TD
    PackageA -->|CONTAINS| PackageOther
    PackageD -->|CONTAINED_BY| PackageA
    PackageA -->|DEPENDS_ON| PackageB
    PackageB -->|DEPENDENCY_OF| PackageA
    SBOMDOC1 -->|DESCRIBES| PackageA
    UpstreamComponent -->|ANCESTOR_OF| PackageA
    image.arch1 -->|VARIANT_OF| ImageIndex1
    image.arch2 -->|VARIANT_OF| ImageIndex1
    SBOMDOC2 -->|DESCRIBES| ImageIndex1

    SBOMDOC3 -->|DESCRIBES| srpm_component
    binarycomponent1 -->|GENERATED_FROM| srpm_component
    binarycomponent2 -->|GENERATED_FROM| srpm_component

Loading

That is in our internal model we will only have one form of the relationship (ex. Describes instead of DescribedBy, Variants instead of VariantOf) resulting in all relationships pointing 'downward' in a directed DAG.

graph TD
    SBOMDOC1 -->|DESCRIBES| PackageA
    PackageA -->|CONTAINS| PackageOther
    PackageA -->|CONTAINS| PackageD
    PackageA -->|DEPENDS| PackageB
    
    SBOMDOC2 -->|DESCRIBES| ImageIndex1
    UpstreamComponent -->|ANCESTOR_OF| PackageA
    ImageIndex1 -->|VARIANTS| image.arch1
    ImageIndex1 -->|VARIANTS| image.arch2

    SBOMDOC3 -->|DESCRIBES| srpm_component
    srpm_component -->|GENERATES| binarycomponent1
    srpm_component -->|GENERATES| binarycomponent2

Loading

This normalisation to a single downward direction makes the resultant conceptual model easier to understand, easier to query and will be easier to maintain.

• removed analysis graph api/v2/analysis/root-component and api/v2/analysis/deps endpoints
• added analysis graph api/v2/analysis/component endpoint
• made numerous simplifying refactorings in the codebase
• fixed a lot of bugs

Example of new graph analysis /component/ endpoint where we

curl -H "Authorization:$(oidc token testing-client --bearer)" "http://localhost:8080/api/v2/analysis/component/curl?ancestors=10" -v | jq 

{
  "items": [
    {
      "sbom_id": "0194cbea-a290-7343-855f-00db9f86a1c2",
      "node_id": "SPDXRef-02e69ad2-f243-4b2e-a3ca-c632629c45a9",
      "purl": [
        "pkg:rpm/redhat/[email protected]_9.1?arch=ppc64"
      ],
      "cpe": [],
      "name": "curl",
      "version": "curl-7.29.0-59.el7_9.1.ppc64",
      "published": "2023-09-05 21:08:00+00",
      "document_id": "https://access.redhat.com/security/data/sbom/beta/spdx/rhel-7.9.z-c98403ce-5e02-4278-98ec-b36ecd1f46a5",
      "product_name": "rhel-7.9.z",
      "product_version": "7.9.z",
      "ancestors": [
        {
          "sbom_id": "0194cbea-a290-7343-855f-00db9f86a1c2",
          "node_id": "SPDXRef-19609913-9f13-40f8-b5ec-429271a17d6b",
          "purl": [
            "pkg:rpm/redhat/[email protected]_9.1?arch=src"
          ],
          "cpe": [],
          "name": "curl",
          "version": "curl-7.29.0-59.el7_9.1.src",
          "published": "2023-09-05 21:08:00+00",
          "document_id": "https://access.redhat.com/security/data/sbom/beta/spdx/rhel-7.9.z-c98403ce-5e02-4278-98ec-b36ecd1f46a5",
          "product_name": "rhel-7.9.z",
          "product_version": "7.9.z",
          "relationship": "contains",
          "ancestors": [
            {
              "sbom_id": "0194cbea-a290-7343-855f-00db9f86a1c2",
              "node_id": "SPDXRef-c98403ce-5e02-4278-98ec-b36ecd1f46a5",
              "purl": [],
              "cpe": [
                "cpe:/o:redhat:enterprise_linux:7:*:server:*",
                "cpe:/o:redhat:enterprise_linux:7:*:computenode:*",
                "cpe:/a:redhat:rhel_extras_other:7:*:*:*",
                "cpe:/a:redhat:rhel_extras_rt:7:*:*:*",
                "cpe:/a:redhat:rhel_extras:7:*:*:*",
                "cpe:/a:redhat:rhel_extras_sap_hana:7:*:*:*",
                "cpe:/o:redhat:enterprise_linux:7:*:workstation:*",
                "cpe:/a:redhat:rhel_extras_sap:7:*:*:*",
                "cpe:/a:redhat:enterprise_linux:7:*:*:*",
                "cpe:/o:redhat:enterprise_linux:7:*:client:*"
              ],
              "name": "rhel-7.9.z",
              "version": "7.9.z",
              "published": "2023-09-05 21:08:00+00",
              "document_id": "https://access.redhat.com/security/data/sbom/beta/spdx/rhel-7.9.z-c98403ce-5e02-4278-98ec-b36ecd1f46a5",
              "product_name": "rhel-7.9.z",
              "product_version": "7.9.z",
              "relationship": "package",
              "ancestors": [
                {
                  "sbom_id": "0194cbea-a290-7343-855f-00db9f86a1c2",
                  "node_id": "SPDXRef-DOCUMENT",
                  "purl": [],
                  "cpe": [],
                  "name": "rhel-7.9.z",
                  "version": "",
                  "published": "2023-09-05 21:08:00+00",
                  "document_id": "https://access.redhat.com/security/data/sbom/beta/spdx/rhel-7.9.z-c98403ce-5e02-4278-98ec-b36ecd1f46a5",
                  "product_name": "rhel-7.9.z",
                  "product_version": "7.9.z",
                  "relationship": "describes",
                  "ancestors": []
                }
              ]
            }
          ]
        }
      ]
    },
... elided ...

Where the nested ancestors show provenance from matched component all the way up to SPDX document describing:

• pkg:rpm/redhat/[email protected]_9.1?arch=ppc64
• CONTAINS pkg:rpm/redhat/[email protected]_9.1?arch=src
• PACKAGES rhel-7.9.z
• DESCRIBES rhel-7.9.z

Similarly It is possible to get descendants of a matched component:

curl -H "Authorization:$(oidc token testing-client --bearer)" "http://localhost:8080/api/v2/analysis/component/curl?descendants=10" -v | jq

Or even both

curl -H "Authorization:$(oidc token testing-client --bearer)" "http://localhost:8080/api/v2/analysis/component/curl?ancestors=2&descendants=2" -v 

Where url params ancestors and descendants control processing depth.

Closes: ##1202, 1203

[JimFuller-RedHat]

LGTM (though I would say this ... this is a big set of changes ... and critical)

[ctron]

I rewrote a few commits to bring down the number. But I think the remaining ones make sense. Alternatively, we squash them all. Which I think makes less sense.

[ctron]

@carlosthe19916 there will be some API changes with the PR. Might have an impact on the UI.

[carlosthe19916]

@carlosthe19916 there will be some API changes with the PR. Might have an impact on the UI.

Just to confirm there was no impact on the UI