CycloneDX / CycloneDX/cyclonedx-dotnet
Is it possible to add the NuGet package source URL to the report
- Dominant language
- C#
- Stars
- 294
- Forks
- 123
- PR merge metrics
- No merged PRs in 30d
Description
### Discussed in https://github.com/CycloneDX/cyclonedx-dotnet/discussions/1096
Originally posted by **paulomorgado** May 27, 2026
I have multiple NuGet sources mapped in my `NuGet.config` file.
I know where each package comes from, but if I hand over the SBOM to a person that does not know it, it can be a daunting task figuring out where each package comes from.
Is there a way to add the NuGet source to each reported NuGet package?
**Refernces:**
- [`nuget.config` reference > Package source mapping section](https://learn.microsoft.com/en-us/nuget/reference/nuget-config-file#package-source-mapping-section)
- [Package Source Mapping > Enable by manually editing `nuget.config`](https://learn.microsoft.com/en-us/nuget/consume-packages/package-source-mapping)
Contributor guide
Research direction
Start by reviewing the discussion in #1096 and the NuGet.config Package Source Mapping references linked in the issue. Determine how each reported NuGet package can be associated with its source URL, then verify that the generated SBOM includes that URL for packages resolved from mapped sources.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 42/100