CBOM: Add CycloneDX v1.6 support for cryptographic assets

[stevespringett]

Current Behavior

Currently, Dependency-Track does not support cryptographic assets.

Proposed Behavior

Add support for cryptographic assets and their dependencies once CycloneDX v1.6 is released.

• Display cryptographic assets in inventory
• Display cryptographic assets in dependency graph
• Display cryptographic-specific fields in component view and modal dialogs
• Add support for dependency types (display on dependency graph)

NOTE: May be able to reach out to IBM Quantum for a git patch or PR, as they've performed an internal fork of DT that adds support for some of these things already.

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this enhancement was already requested

[n1ckl0sk0rtge]

@stevespringett @VinodAnandan could you assign this issue to me, would like to work on it.

FYI @san-zrl

[dshafranskiy-r7]

@n1ckl0sk0rtge do you have any ETA on that feature being implemented ?

[n1ckl0sk0rtge]

Hi @dshafranskiy-r7, not yet, but we are working on it, see

• feat: CBOM support
• feat: render CBOM data

Together with the Dependency Track maintainers, we decided to implement this feature for Dependency Track 5.x.