CycloneDX / CycloneDX/cyclonedx-dotnet
Include other dependencies than package references
- Dominant language
- C#
- Stars
- 294
- Forks
- 123
- PR merge metrics
- No merged PRs in 30d
Description
When generating an SBOM from a `.csproj` file, only `` dependencies are included in the SBOM. We are also interested in adding dependencies which are output manually, e.g.:
```
PreserveNewest
```
[A quick glance at the source code](https://github.com/CycloneDX/cyclonedx-dotnet/blob/master/CycloneDX/Services/ProjectFileService.cs#L176) shows that `GetProjectDotnetDependencyAsync()` operates on `dotnet restore`'s output in `obj/project.assets.json`, which indeed only includes nuget references.
Is there a plan to also represent such files in generated SBOMs?
Contributor guide
Research direction
Start in CycloneDX/Services/ProjectFileService.cs around GetProjectDotnetDependencyAsync() and compare its project.assets.json input with the .csproj example in the issue. Determine how manually included files such as None Include="non-nuget.dll" should be represented in generated SBOMs. Done means these dependencies are included without breaking existing PackageReference handling.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100