CycloneDX / CycloneDX/cyclonedx-dotnet

combining --disable-package-restore and --target-framework (with prior restore) does not work

Open
#1,101 0 comments 1 reaction 0 assignees View on GitHub
triage
Dominant language
C#
Stars
294
Forks
123
PR merge metrics
No merged PRs in 30d

Description

I currently generate a seperate BOM for each target framework of my library projects (because the dependencies differ between frameworks and i want to minimize false positive vulnerability alerts).
With about ten separate packages and five target frameworks for each package, i end up invoking the tool about fifty times in a loop.
I had the idea to speed up the generation process by running a global NuGet restore on the complete solution up front and then invoke the tool with -tfm XYZ and --disable-package-restore.

But this does not work, all dependencies of all targets are combined into each bom, the -tfm switch is ignored.
Although looking into the assets.json, the dependencies are listed for each target framework separately, so in theory filtering the assets.json info by target framework should be possible.

Contributor guide

Open the contributing guide

Research direction

Start by tracing how --disable-package-restore and -tfm are handled when reading the restored assets.json files. Confirm how target frameworks are selected, then verify that each generated BOM contains only the dependencies for the requested framework across the reported multi-framework project case.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
devtools, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.