Support running the analysis with the SBOM without having to provide the repo path about macaron

[behnazh-w]

We can remove #158 from tasks in this issue and track that separately.

[tromai]

I have thought about this a bit and these are the initial ideas that I can come up with:

1. Change how we handle the user arguments here so that the users could provide the SBOM only for the analysis without having to provide either the repo path (-rp) or the config file (-c). It should be able to handle the following scenarios:

• The main target is provided (via either -rp or -c) together with the SBOM. In this case, we need to come up with the priority between (whether the config will override the SBOM, etc.) and how we can merge and validate the consistency between the information available in those sources. However, we could consider prohibit the users from doing it.
• The main target is not provided (via either -rp or -c) together with the SBOM. In this case, we only try to extract the information of the main target and the dependencies from the SBOM and perform the analysis as usual. However, there are 2 sub-scenarios as well:
  • The main target repo is not available (i.e SCM information is not available, Exceptions during preparing the repo, etc.) -> we still need to run the analysis against the dependencies from the SBOM (if available). We need to modify this part where the analysis stops if we failed to analyze the main target.
  • We can extract the SCM information of the main target from the SBOM -> we don't run the dependency analyzer and use the dependencies extracted from the SBOM.

2. In scenarios where we cannot finish the analysis for the main target, but we still need to analyze the dependencies, we must be able to display in the reports that the main target is "Empty/Error" while still contain the information of the dependencies (if available). Therefore, we need to improve our HTML template to incorporate this.

[behnazh-w]

We should break this into two PRs.

• One for handling the case where the main target repo is not provided via -rp or -c, in which case we should still properly analyze the dependencies and the main target results (not available) should be reflected in the reports.
• A separate PR can take care of the case where we need to resolve the main target repository through the SBOM itself.

[tromai]

Sounds good to me. I will create another 2 GH issues and link it to this main issue.

[tromai]

Thanks @behnazh-w I close this issue.