CycloneDX / CycloneDX/cyclonedx-dotnet
CycloneDX.NET finishes successfully when package restore fails
- Dominant language
- C#
- Stars
- 294
- Forks
- 123
- PR merge metrics
- No merged PRs in 30d
Description
Hi,
I'm using version `3.0.5` and recently noticed that in case solution package restore fails CycloneDX.NET does not generate BOM file and finishes successfully. This makes our BOM builds to continue and fail at a later point because BOM file is not found.
Wouldn't it be better that CycloneDX.NET exits with a code that indicates failure?
Here is an example of shortened build output with key points **in bold**:
> 15:03:48 **Dotnet restore failed:**
> 15:03:48 Determining projects to restore...
> 15:03:48 D:\BuildAgent\work\8459948641e4ad25\Services\ServiceName\src\Models\Models.csproj : **error NU1903: Warning As Error:** Package 'Newtonsoft.Json' 12.0.3 has a known high severity vulnerability, https://github.com/advisories/GHSA-5crp-9r3c-p9vr [D:\BuildAgent\work\8459948641e4ad25\Services\ServiceName\src\WorkerHost\WorkerHost.csproj]
> 15:03:48 **Failed to restore** D:\BuildAgent\work\8459948641e4ad25\Services\ServiceName\src\Models\Models.csproj (in 18 ms).
> 15:03:48
> 15:03:48 CycloneDX has finished
> 15:03:48
> 15:03:48 **Process exited with code 0**
>
> 15:03:48 Step 2/2: Upload BOM to DependencyTrack
> 15:03:48 Step 1/1: Upload BOM to DependencyTrack (PowerShell)
> 15:03:48 PowerShell running in non-virtual agent context
> 15:03:48 PowerShell Executable: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
> 15:03:48 Working directory: D:\BuildAgent\work\8459948641e4ad25
> 15:03:48 Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
> 15:03:48 PowerShell arguments: -NoProfile, -NonInteractive, -ExecutionPolicy, ByPass, -File, D:\BuildAgent\temp\buildTmp\powershell12874135734340666064.ps1, "D:\BuildAgent\work\8459948641e4ad25", "dist/BOM/bom.json", "*******", "https://dependencytrack_url/api", "ServiceName", "1.2.3.4"
> 15:03:48 Get-ChildItem : **Cannot find path 'D:\BuildAgent\work\8459948641e4ad25\dist\BOM\bom.json' because it does not exist.**
Contributor guide
Research direction
Start by reproducing the failed .NET package restore described in the issue and trace how CycloneDX.NET handles that failure before reporting completion. The work is done when a restore failure produces a nonzero process exit code instead of successful completion; no source file or test path is named in the report.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- cli
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100