Feature Requests

The SSCA artifact signing and verify steps export the image to a docker-archive tar and cosign reads it whole, so the step's memory grows with the image. A 4.7 GB image needs a 16Gi limit to sign. On Kubernetes build infra sequential steps share the pod and every container gets the largest limit, so every build pod becomes a 16Gi pod. Request: sign the image digest instead of the tarball for keyless (Fulcio) signing, as cosign sign image@digest does, so memory stays constant.

Component enrichment data already includes End-of-Life (EOL) status, but there's currently no way to build an account-level Custom Dashboard that combines artifact and component data with EOL details. For organizations with a large software supply chain footprint, this kind of dashboard is important for prioritizing remediation and supporting compliance and audit reporting We'd like to see an account-level SBOM Custom Dashboard view joining artifact and component data with EOL status, backed by a data model that can scale to very high artifact/component volumes

Module: Software Supply Chain Security (SCS) Problem Statement: When a vulnerable or problematic transitive dependency appears in an SBOM, security teams need to understand how it entered the dependency tree. Currently, Harness SCS provides forward dependency traversal (scs_component_dependencies — what does package X depend on?) but lacks reverse dependency lookup (what depends on package X?). Without this capability, teams must leave Harness and run local tooling (npm why, npm ls) to trace dependency paths, breaking the security investigation workflow. Proposed Solution: Add a "Reverse Dependencies" or "Dependents" view for SBOM components that answers: "Which direct dependencies in my project pulled in this transitive package?" This could be: A new API endpoint / resource type (e.g., scs_component_dependents) An addition to the existing component detail view in the UI A filter option on scs_component_dependencies to reverse the traversal direction Use Cases: Vulnerability remediation: A CVE is found in a deeply nested transitive dependency. Teams need to know which direct dependency to upgrade or replace. License compliance: A transitive package has a problematic license. Teams need to trace which dependency introduced it. Dependency cleanup: Reducing bundle size by understanding why unused packages exist in the tree. Policy enforcement: Writing governance rules that account for transitive dependency chains. Expected Behavior: Given a component PURL (e.g., pkg:npm/lodash@4.17.20), return all components in the same artifact that depend on it, with the full dependency path back to direct dependencie

Supply chain attacks compromise a dependency, action, or base image that a pipeline pulls in, and the malicious code then runs inside the build with access to credentials, network egress, and the filesystem. Recent incidents like the litellm compromise are examples of this. Existing controls are static, dependency and image scanning catch known-bad artifacts before execution, but not a package that scans clean and behaves maliciously at runtime. Today there is no way to tell whether a build contacted an unexpected host or read files outside its scope.

Request a Harness-supported API endpoint that allows authorized automation to update an SCS license family and manage direct and indirect dependency relationships in a way that is compliant with internal firm standards (e.g., governance, auditability, RBAC, validation, and change controls). Without an API: -Changes are manual, inconsistent, and hard to govern -We cannot enforce required approval, validation, or audit controls -Dependency graph correctness drifts, increasing operational and compliance risk

Request to implement a connector for google KMS like HasiCorp Secret Manager to support cloud migration https://docs.sigstore.dev/cosign/key_management/overview/#gcp

For using COSIGN in the SCS module to sign container images and SBOMs, we want to be able to store and source signing keys and certificates from a connected KMS key store.

Similar to STO, we are requesting for the Supply Chain Security module to allow for license exemption by component. Requesting the person who created the exemption be different then the person who approves the exemption. Additionally requesting the ability to exempt by project, org, or account level depending on if the role access is for a project, org, or account level access.

Request to enhance the Harness supply chain supply module by integrating LicenseConditions attributes into the Harness UI, enabling visibility and filtering. Requested Enhancement: Add the following LicenseConditions attributes as columns in the Harness UI: name description message additionalGuidance Filtering Capability: Enable users to filter supply chain items based on these LicenseConditions attributes Rationale: Improves transparency and compliance tracking by making license conditions easily accessible. Allows users to quickly identify and act on supply chain items with specific license requirements or guidance. Streamlines workflow by enabling targeted filtering and sorting. Example UI Change: Add new columns for each attribute in relevant supply chain tables. Provide filter options for each attribute (e.g., search by name, filter by guidance). Impact: Enhances user experience and compliance management. Reduces manual effort in tracking license conditions. Example JSON { "spdxId": "MIT", "name": "MIT License", "legalStatus": "Approved", "policyColorDesignation": "GREEN", "policyColorMessage": "Does not trigger copyleft obligations. Generally ok to proceed as long as minor obligations (attribution, etc.) are complied with.", >>>> "licenseConditions": [ { "name": "must_attribute", "description": "Need to Attribute", "message": "\"Need to Attribute\" means distribution requires attribution through copyright notice, as specified by the license", "additionalGuidance": null },

After doing a SBOM orchestration and trivy scan, the portal UI shows the SBOM OSS Risk field, but when downloading the sbom, this field is not available, nor does there seem to be a GET api call for this.