CycloneDX / CycloneDX/cyclonedx-dotnet

Utilize package mapping to source additional information

Open
#845 1 comment 0 reactions 0 assignees View on GitHub
enhancement stale
Dominant language
C#
Stars
294
Forks
123
PR merge metrics
No merged PRs in 30d

Description

This issue is a continuation of #842

With the introduction of package source mapping (https://devblogs.microsoft.com/nuget/introducing-package-source-mapping/) it should now be possible for cyclonedx to determine who the supplier of the nuget package is.

The idea is to read the package source mapping and then set the supplier accordingly.

**Assumptions**
Nuget.Config file exists within either the project directory or the solution direction.

Contributor guide

Open the contributing guide

Research direction

Start by reviewing issue #842 and the NuGet package source mapping documentation linked here, then inspect how the project currently determines package suppliers. Use the NuGet.Config located in the project or solution directory as the input; done means the supplier is set from the package source mapping when available.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
tooling
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.