CycloneDX / CycloneDX/cyclonedx-dotnet

Using a custom packageSourceMapping in the nuget.config breaks generation

Open
#1,127 0 comments 0 reactions 0 assignees View on GitHub
triage
Dominant language
C#
Stars
294
Forks
123
PR merge metrics
No merged PRs in 30d

Description

Hi,

When using a nuget.config like:

```
















```

I get this error:

```
Unable to extract the nuget package: DevExpress.Data.Desktop - 22.1.5
Unhandled exception. System.IO.InvalidDataException: Central Directory corrupt.
---> System.IO.IOException: An attempt was made to move the position before the beginning of the stream.
at System.IO.MemoryStream.SeekCore(Int64 offset, Int32 loc)
at System.IO.Compression.ZipArchive.ReadEndOfCentralDirectory()
--- End of inner exception stack trace ---
at System.IO.Compression.ZipArchive.ReadEndOfCentralDirectory()
at System.IO.Compression.ZipArchive..ctor(Stream stream, ZipArchiveMode mode, Boolean leaveOpen, Encoding entryNameEncoding)
at System.IO.Compression.ZipArchive..ctor(Stream stream, ZipArchiveMode mode, Boolean leaveOpen)
at NuGet.Packaging.PackageArchiveReader..ctor(Stream stream, Boolean leaveStreamOpen, IFrameworkNameProvider frameworkProvider, IFrameworkCompatibilityProvider compatibilityProvider)
at NuGet.Packaging.PackageArchiveReader..ctor(Stream stream)
at CycloneDX.Services.NugetV3Service.GetNuspec(String name, String version, String nuspecFilename, FindPackageByIdResource resource) in /home/runner/work/cyclonedx-dotnet/cyclonedx-dotnet/CycloneDX/Services/NugetV3Service.cs:line 477
at CycloneDX.Services.NugetV3Service.GetNuspec(String name, String version, String nuspecFilename, FindPackageByIdResource resource) in /home/runner/work/cyclonedx-dotnet/cyclonedx-dotnet/CycloneDX/Services/NugetV3Service.cs:line 488
at CycloneDX.Services.NugetV3Service.GetComponentAsync(String name, String version, Nullable`1 scope) in /home/runner/work/cyclonedx-dotnet/cyclonedx-dotnet/CycloneDX/Services/NugetV3Service.cs:line 255
at CycloneDX.Services.NugetV3Service.GetComponentAsync(DotnetDependency DotnetDependency) in /home/runner/work/cyclonedx-dotnet/cyclonedx-dotnet/CycloneDX/Services/NugetV3Service.cs:line 530
at CycloneDX.Runner.HandleCommandAsync(RunOptions options) in /home/runner/work/cyclonedx-dotnet/cyclonedx-dotnet/CycloneDX/Runner.cs:line 323
at CycloneDX.Program.Main(String[] args) in /home/runner/work/cyclonedx-dotnet/cyclonedx-dotnet/CycloneDX/Program.cs:line 192
at CycloneDX.Program.(String[] args)
```

Contributor guide

Open the contributing guide

Research direction

Reproduce the failure with the shown nuget.config, then start in CycloneDX/Services/NugetV3Service.cs around GetNuspec at lines 477-488 and GetComponentAsync at line 255. Trace how the package source mapping affects extraction; done means generation completes and DevExpress.Data.Desktop is extracted without the central-directory error.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.