microsoft / microsoft/component-detection
Why are NuGet project references not included?
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 553
- Forks
- 135
- Avg merge
- 20h 58m
- Merged PRs (30d)
- 6
Description
I'm trying to generate an SBOM using sbom-tool, which uses this package to find dependencies through NuGet configurations. I noticed that project references are missing.
When running component-detection in isolation, I noticed that project references are also omitted in the output. Running a debugger, I can see that there is specific code to parse them, but, they get filtered out in final NavigateAndRegister().
What is the reason for this? This means that I won't see components used by these projects, which is a requirement for my SBOM output. This code was introduced in the "initial commit", so not much more information I can gather from git history.
When removing the early out for || library.Type == ProjectDependencyType, output seems to work fine. Except, the project references show up as "NuGet" references in the ScanManifest, instead of "project" references. I.e., they have " - NuGet" appended to their name and version.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in src/Microsoft.ComponentDetection.Detectors/nuget/NuGetProjectModelProjectCentricComponentDetector.cs, especially NavigateAndRegister() and the ProjectDependencyType early-out. Trace how project references reach the ScanManifest and determine the intended distinction between NuGet and project references. Done means project references are included without being mislabeled as NuGet components.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- devtools
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100