CycloneDX / CycloneDX/cyclonedx-dotnet
combining --disable-package-restore and --target-framework (with prior restore) does not work
- Dominant language
- C#
- Stars
- 294
- Forks
- 123
- PR merge metrics
- No merged PRs in 30d
Description
I currently generate a seperate BOM for each target framework of my library projects (because the dependencies differ between frameworks and i want to minimize false positive vulnerability alerts).
With about ten separate packages and five target frameworks for each package, i end up invoking the tool about fifty times in a loop.
I had the idea to speed up the generation process by running a global NuGet restore on the complete solution up front and then invoke the tool with -tfm XYZ and --disable-package-restore.
But this does not work, all dependencies of all targets are combined into each bom, the -tfm switch is ignored.
Although looking into the assets.json, the dependencies are listed for each target framework separately, so in theory filtering the assets.json info by target framework should be possible.
Contributor guide
Research direction
Start by tracing how --disable-package-restore and -tfm are handled when reading the restored assets.json files. Confirm how target frameworks are selected, then verify that each generated BOM contains only the dependencies for the requested framework across the reported multi-framework project case.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- devtools, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100