hi
i am trying to build a SBOM in neo4j, and i am struggling to create relations between transitive dependencies
i have two different types of nodes, projects and dependencies
The project has information about the level1 dependencies and level 2 dependencies
project1 = {'name': 'test1', 'timestamp': '2020-08-03T03:20:53.771Z', 'urn': 'urn:uuid:1f860713-54b9-4253-ba5a-9554851904af', 'dependenciesl1': ['pkg:npm/body-parser@1.19.0'], 'dependenciesl2': [ ]}
project2 = {'name': 'test2', 'timestamp': '2020-08-03T03:20:53.771Z', 'urn': 'urn:uuid:1f860713-54b9-4253-ba5a-9554851904ag', 'dependenciesl1': ['pkg:npm/body-parser@1.19.0'], 'dependenciesl2': ['pkg:npm/level2@1.19.0'] }
I also have another node, dependency, which contain information about the dependency, and the second level dependencies.
dep1: {'purl': 'pkg:npm/body-parser@1.19.0', 'dependency': 'body-parser@1.19.0', 'l2': ['pkg:npm/level2@1.19.0']}
dep2: {'purl': 'pkg:npm/level2@1.19.0', 'dependency': 'level2@1.19.0', 'l2': []}
With this information, i want to create a relation between project and L1 dependencies, which i have already done, but i also want to create another relation, between L1 dependencies and L2 dependencies. The problem is, that in different projects, that l2 relation might be enabled or not. This will be determined by project.l2
To clarify, the logic i want to create for the relation is
dep1 -> TRANSITIVE->dep2 when dep2 in dep1.l2 AND dep2.purl in project.dependenciesl2
What i expect to see in the graph is
test1->USES->dep1
test2->USES->dep1->TRANSITIVE->dep2
Is there any way to do that?
Thanks