BOM validation soft failing about dependency-track HOT 3 OPEN

I like the idea of this "continue-on-error" kind of validation.

We had to turn off BOM validation due to external references URL being invalid from cdxgen (CycloneDX/cdxgen#1107), so definitely see the value here.

The enum approach sounds neat. Maybe could call it Validation Mode? (STRICT, LENIENT, DISABLED)

from dependency-track.

Add another state "soft validation"

Instead of the soft validation wording, I'd prefer the current boolean option Validation enabled to become a BomValidation enum with possible values being along the lines of:

• DISABLED - Do nothing
• MONITOR - Log and alert
• ENFORCE - Reject invalid BOMs (still log and alert?)

2c) Possibly gives feedback in return of API call

This could lead to some confusion / inconsistencies WRT API design. Getting a successful (HTTP 200) response that indicates errors in its body is an anti-pattern. Not sure how to implement this suggestion in a sensible way.

from dependency-track.

2c) Possibly gives feedback in return of API call

This could lead to some confusion / inconsistencies WRT API design. Getting a successful (HTTP 200) response that indicates errors in its body is an anti-pattern. Not sure how to implement this suggestion in a sensible way.

Not a hard requirement from me, just thought it could come handy for some people. However, I think if its a "Warning" not an Error, it could be fine to return.

from dependency-track.