Dependency Graph is not showing

[software-testing-professional]

Hi together,

I'm using Dependency-Track v4.4.2.
SBOMs are created with OSS Review Toolkit, which can create CycloneDX (JSON or XML) and SPDX files.

Everything works fine, except the Dependency Graph.
None of the projects in Dependency-Track has the Dependency-Graph populated.

The logs are looking fine...

2022-05-05 07:31:35,115 INFO [BomUploadProcessingTask] Processing CycloneDX BOM uploaded to project: 22eebe63-ee48-40d4-85f6-140e6dfcdd8e
2022-05-05 07:31:39,467 INFO [BomUploadProcessingTask] Processing CycloneDX dependency graph for project: 22eebe63-ee48-40d4-85f6-140e6dfcdd8e
2022-05-05 07:31:39,487 INFO [BomUploadProcessingTask] Processed 87 components and 0 services uploaded to project 22eebe63-ee48-40d4-85f6-140e6dfcdd8e
2022-05-05 07:31:39,665 INFO [InternalAnalysisTask] Starting internal analysis task
2022-05-05 07:31:39,965 INFO [InternalAnalysisTask] Internal analysis complete
2022-05-05 07:31:39,970 WARN [OssIndexAnalysisTask] An API username or token has not been specified for use with OSS Index. Using anonymous access
2022-05-05 07:31:39,970 INFO [OssIndexAnalysisTask] Starting Sonatype OSS Index analysis task
2022-05-05 07:31:40,320 INFO [OssIndexAnalysisTask] Sonatype OSS Index analysis complete
2022-05-05 07:31:40,320 INFO [PolicyEngine] Evaluating 87 component(s) against applicable policies
2022-05-05 07:31:41,849 INFO [PolicyEngine] Policy analysis complete
2022-05-05 07:31:41,852 INFO [MetricsUpdateTask] Executing metrics update for project: 22eebe63-ee48-40d4-85f6-140e6dfcdd8e
2022-05-05 07:31:43,631 INFO [MetricsUpdateTask] Completed metrics update for project: 22eebe63-ee48-40d4-85f6-140e6dfcdd8e

I'm not sure whether this is a problem with the SBOMs, or with Dependency-Track itself.
Any ideas on this? Or any aspects I should check?

I appreciate your help!

Best regards, Michael

[VinodAnandan]

I think this is related to this ORT issue - oss-review-toolkit/ort#3906. Maybe sschuberth has a better understanding of capturing the dependency graph in CycloneDX BOM using ORT.

[software-testing-professional]

Thank you for that hint. So the Graph is taken directly from the CycloneDX file, instead of assembling it in Dependency-Track.
This seems to be the reason for me not having a Dependency Graph.