microsoft / microsoft/sbom-tool

Dependencies in manifest are a flat list instead of graph for .NET Solution

Open
#585 1 comment 4 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

tabled
Dominant language
C#
Stars
2.1k
Forks
201
Avg merge
6d 21h
Merged PRs (30d)
1

Description

Problem

In the resulting manifest.spdx.json file created by SBOM Tool, the "relationships" are all defined as depending on SPDXRef-RootPackage instead of the proper subdependency.

Context

I have created a simple Hello-World C# project, and added some random dependencies. You can find the project I used here:
hello-world-dotnet.zip

Then, I ran dotnet restore. This creates the project.assets.json file, which is read by Component-Detection.

To be sure Component-Detection works as expected, I used .\componentdetection.exe scan --SourceDirectory . --SourceFileRoot . --ManifestFile componentdetection_manifest.json. This generated the file componentdetection_manifest.json. In this file, the dependencies are stored as a graph, not a flat list where all dependencies point to the root package:
afbeelding

But when executing .\sbom.exe Generate -b . -bc . -ps "MyTest" -pn "MyPackageName" -pv "1.0.0", this hierarchy is not kept in the resulting spdx file: manifest.spdx.json
afbeelding

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by comparing the dependency relationships in project.assets.json and componentdetection_manifest.json with those in manifest.spdx.json produced by the shown sbom Generate command. Trace how the .NET Solution dependency data is transferred into the SPDX output; done means the resulting relationships preserve the subdependency graph rather than pointing every dependency to SPDXRef-RootPackage.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
devtools, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.