New VersionDistance policy to check and report outdated components

[walterdeboer]

Description

Dependenct Track now supports a Component Age policy and a Component Version policy, but both are unsuitable to detect outdated components. For this the distance between the current component version and it's latest version needs to be analysed.

The VersionDistancePolicyEvaluator evaluates the VersionDistance between a Component's current and it's latest version. The policy "greater than 0:1.?.?" for example, means a difference of only one between the curren version's major number and the latest version's major number is allowed.

Combining VersionDistances is also supported: "greater than 1:1.?.?". This way multiple parts (epoch or major) number can be considered in one go, combining them with a Boolean OR. Not sure yet if this will be supported in the UI...

Addressed Issue

closes #2528, addresses #208, #257

Additional Details

Together with the Age Policy and the Version Policy this would enable advanced policies like "no outdated versions (one major difference), but only if the minor version is at least exactly 1 and when it is older than 21 days. (3.0.0 is to early, but 3.1.0 is considered safe, when it's older than three weeks without a patch release)"

Accompanying PR for the frontend DependencyTrack/frontend#432

Checklist

• I have read and understand the contributing guidelines
• This PR fixes a defect, and I have provided tests to verify that the fix is effective
• This PR implements an enhancement, and I have provided tests to verify that it works as intended
• This PR introduces changes to the database model, and I have added corresponding update logic
• This PR introduces new or alters existing behavior, and I have updated the documentation accordingly

[sonatype-lift]

🛠 Lift Auto-fix

Some of the Lift findings in this PR can be automatically fixed. You can download and apply these changes in your local project directory of your branch to review the suggestions before committing.¹

# Download the patch
curl https://lift.sonatype.com/api/patch/github.com/DependencyTrack/dependency-track/2537.diff -o lift-autofixes.diff

# Apply the patch with git
git apply lift-autofixes.diff

# Review the changes
git diff

Want it all in a single command? Open a terminal in your project's directory and copy and paste the following command:

curl https://lift.sonatype.com/api/patch/github.com/DependencyTrack/dependency-track/2537.diff | git apply

Once you're satisfied, commit and push your changes in your project.

Footnotes

1. You can preview the patch by opening the patch URL in the browser. ↩

[melba-lopez]

@walterdeboer super excited to see this come to life! Been wanting to see how backlevel (versus just an amber).

I do have a question. What happens when the versions have letters in them?? I may not be seeing the code properly, but I'm not seeing anything handling that use case.

[walterdeboer]

For now this works best on SemVer I guess. There is no strict defined math for version numbers, especially when something else than SemVer is used. So it's all best effort here... But I hope this will help al lot for the 95% where decent version numbering is used :-) The first three numbers will be most significant in almost every case. More logic might be added to handle letters but for now I don't feel the urge. Maybe someone else will :-)

[nscuro]

@walterdeboer There seems to be a mismatch on the policy condition value, between what the frontend sends and what the evaluator in the API server expects. I have the following condition configured:

When this is evaluated, I'm getting these errors logged:

2023-07-01 18:25:41,917 ERROR [VersionDistancePolicyEvaluator] Invalid version distance format
java.lang.NumberFormatException: Invallid version distance: {"epoch":null,"major":1,"minor":null,"patch":null}
	at org.dependencytrack.util.VersionDistance.<init>(VersionDistance.java:117)
	at org.dependencytrack.policy.VersionDistancePolicyEvaluator.evaluate(VersionDistancePolicyEvaluator.java:98)
	at org.dependencytrack.policy.VersionDistancePolicyEvaluator.evaluate(VersionDistancePolicyEvaluator.java:87)
	at org.dependencytrack.policy.PolicyEngine.evaluate(PolicyEngine.java:89)
	at org.dependencytrack.policy.PolicyEngine.evaluate(PolicyEngine.java:71)
	at org.dependencytrack.tasks.PolicyEvaluationTask.performPolicyEvaluation(PolicyEvaluationTask.java:55)
	at org.dependencytrack.tasks.PolicyEvaluationTask.inform(PolicyEvaluationTask.java:44)

It seems to me that the evaluator is expecting a simple string, but it's getting a JSON object instead.

[walterdeboer]

@nscuro please try again