CycloneDX / CycloneDX/cyclonedx-dotnet
Using a custom packageSourceMapping in the nuget.config breaks generation
- Dominant language
- C#
- Stars
- 294
- Forks
- 123
- PR merge metrics
- No merged PRs in 30d
Description
Hi,
When using a nuget.config like:
```
```
I get this error:
```
Unable to extract the nuget package: DevExpress.Data.Desktop - 22.1.5
Unhandled exception. System.IO.InvalidDataException: Central Directory corrupt.
---> System.IO.IOException: An attempt was made to move the position before the beginning of the stream.
at System.IO.MemoryStream.SeekCore(Int64 offset, Int32 loc)
at System.IO.Compression.ZipArchive.ReadEndOfCentralDirectory()
--- End of inner exception stack trace ---
at System.IO.Compression.ZipArchive.ReadEndOfCentralDirectory()
at System.IO.Compression.ZipArchive..ctor(Stream stream, ZipArchiveMode mode, Boolean leaveOpen, Encoding entryNameEncoding)
at System.IO.Compression.ZipArchive..ctor(Stream stream, ZipArchiveMode mode, Boolean leaveOpen)
at NuGet.Packaging.PackageArchiveReader..ctor(Stream stream, Boolean leaveStreamOpen, IFrameworkNameProvider frameworkProvider, IFrameworkCompatibilityProvider compatibilityProvider)
at NuGet.Packaging.PackageArchiveReader..ctor(Stream stream)
at CycloneDX.Services.NugetV3Service.GetNuspec(String name, String version, String nuspecFilename, FindPackageByIdResource resource) in /home/runner/work/cyclonedx-dotnet/cyclonedx-dotnet/CycloneDX/Services/NugetV3Service.cs:line 477
at CycloneDX.Services.NugetV3Service.GetNuspec(String name, String version, String nuspecFilename, FindPackageByIdResource resource) in /home/runner/work/cyclonedx-dotnet/cyclonedx-dotnet/CycloneDX/Services/NugetV3Service.cs:line 488
at CycloneDX.Services.NugetV3Service.GetComponentAsync(String name, String version, Nullable`1 scope) in /home/runner/work/cyclonedx-dotnet/cyclonedx-dotnet/CycloneDX/Services/NugetV3Service.cs:line 255
at CycloneDX.Services.NugetV3Service.GetComponentAsync(DotnetDependency DotnetDependency) in /home/runner/work/cyclonedx-dotnet/cyclonedx-dotnet/CycloneDX/Services/NugetV3Service.cs:line 530
at CycloneDX.Runner.HandleCommandAsync(RunOptions options) in /home/runner/work/cyclonedx-dotnet/cyclonedx-dotnet/CycloneDX/Runner.cs:line 323
at CycloneDX.Program.Main(String[] args) in /home/runner/work/cyclonedx-dotnet/cyclonedx-dotnet/CycloneDX/Program.cs:line 192
at CycloneDX.Program.(String[] args)
```
Contributor guide
Research direction
Reproduce the failure with the shown nuget.config, then start in CycloneDX/Services/NugetV3Service.cs around GetNuspec at lines 477-488 and GetComponentAsync at line 255. Trace how the package source mapping affects extraction; done means generation completes and DevExpress.Data.Desktop is extracted without the central-directory error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 58/100