CycloneDX / CycloneDX/cyclonedx-dotnet

Include other dependencies than package references

Open
#932 2 comments 4 reactions 0 assignees View on GitHub
enhancement help wanted ready for development
Dominant language
C#
Stars
294
Forks
123
PR merge metrics
No merged PRs in 30d

Description

When generating an SBOM from a `.csproj` file, only `` dependencies are included in the SBOM. We are also interested in adding dependencies which are output manually, e.g.:

```

PreserveNewest

```

[A quick glance at the source code](https://github.com/CycloneDX/cyclonedx-dotnet/blob/master/CycloneDX/Services/ProjectFileService.cs#L176) shows that `GetProjectDotnetDependencyAsync()` operates on `dotnet restore`'s output in `obj/project.assets.json`, which indeed only includes nuget references.

Is there a plan to also represent such files in generated SBOMs?

Contributor guide

Open the contributing guide

Research direction

Start in CycloneDX/Services/ProjectFileService.cs around GetProjectDotnetDependencyAsync() and compare its project.assets.json input with the .csproj example in the issue. Determine how manually included files such as None Include="non-nuget.dll" should be represented in generated SBOMs. Done means these dependencies are included without breaking existing PackageReference handling.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.