microsoft / microsoft/component-detection

Why are NuGet project references not included?

Open
#1,029 6 comments 6 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C#
Stars
553
Forks
135
Avg merge
20h 58m
Merged PRs (30d)
6

Description

I'm trying to generate an SBOM using sbom-tool, which uses this package to find dependencies through NuGet configurations. I noticed that project references are missing.

When running component-detection in isolation, I noticed that project references are also omitted in the output. Running a debugger, I can see that there is specific code to parse them, but, they get filtered out in final NavigateAndRegister().

What is the reason for this? This means that I won't see components used by these projects, which is a requirement for my SBOM output. This code was introduced in the "initial commit", so not much more information I can gather from git history.

When removing the early out for || library.Type == ProjectDependencyType, output seems to work fine. Except, the project references show up as "NuGet" references in the ScanManifest, instead of "project" references. I.e., they have " - NuGet" appended to their name and version.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in src/Microsoft.ComponentDetection.Detectors/nuget/NuGetProjectModelProjectCentricComponentDetector.cs, especially NavigateAndRegister() and the ProjectDependencyType early-out. Trace how project references reach the ScanManifest and determine the intended distinction between NuGet and project references. Done means project references are included without being mislabeled as NuGet components.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
devtools
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.