CycloneDX / CycloneDX/cyclonedx-dotnet

CycloneDX.NET finishes successfully when package restore fails

Open
#888 5 comments 0 reactions 0 assignees View on GitHub
bug question stale
Dominant language
C#
Stars
294
Forks
123
PR merge metrics
No merged PRs in 30d

Description

Hi,

I'm using version `3.0.5` and recently noticed that in case solution package restore fails CycloneDX.NET does not generate BOM file and finishes successfully. This makes our BOM builds to continue and fail at a later point because BOM file is not found.

Wouldn't it be better that CycloneDX.NET exits with a code that indicates failure?

Here is an example of shortened build output with key points **in bold**:

> 15:03:48  **Dotnet restore failed:**
> 15:03:48  Determining projects to restore...
> 15:03:48  D:\BuildAgent\work\8459948641e4ad25\Services\ServiceName\src\Models\Models.csproj : **error NU1903: Warning As Error:** Package 'Newtonsoft.Json' 12.0.3 has a known high severity vulnerability, https://github.com/advisories/GHSA-5crp-9r3c-p9vr [D:\BuildAgent\work\8459948641e4ad25\Services\ServiceName\src\WorkerHost\WorkerHost.csproj]
> 15:03:48  **Failed to restore** D:\BuildAgent\work\8459948641e4ad25\Services\ServiceName\src\Models\Models.csproj (in 18 ms).
> 15:03:48 
> 15:03:48  CycloneDX has finished
> 15:03:48 
> 15:03:48  **Process exited with code 0**
>
> 15:03:48 Step 2/2: Upload BOM to DependencyTrack
> 15:03:48  Step 1/1: Upload BOM to DependencyTrack (PowerShell)
> 15:03:48  PowerShell running in non-virtual agent context
> 15:03:48  PowerShell Executable: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
> 15:03:48  Working directory: D:\BuildAgent\work\8459948641e4ad25
> 15:03:48  Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
> 15:03:48  PowerShell arguments: -NoProfile, -NonInteractive, -ExecutionPolicy, ByPass, -File, D:\BuildAgent\temp\buildTmp\powershell12874135734340666064.ps1, "D:\BuildAgent\work\8459948641e4ad25", "dist/BOM/bom.json", "*******", "https://dependencytrack_url/api", "ServiceName", "1.2.3.4"
> 15:03:48  Get-ChildItem : **Cannot find path 'D:\BuildAgent\work\8459948641e4ad25\dist\BOM\bom.json' because it does not exist.**

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the failed .NET package restore described in the issue and trace how CycloneDX.NET handles that failure before reporting completion. The work is done when a restore failure produces a nonzero process exit code instead of successful completion; no source file or test path is named in the report.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.