microsoft / microsoft/sbom-tool
Dependencies in manifest are a flat list instead of graph for .NET Solution
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 2.1k
- Forks
- 201
- Avg merge
- 6d 21h
- Merged PRs (30d)
- 1
Description
Problem
In the resulting manifest.spdx.json file created by SBOM Tool, the "relationships" are all defined as depending on SPDXRef-RootPackage instead of the proper subdependency.
Context
I have created a simple Hello-World C# project, and added some random dependencies. You can find the project I used here:
hello-world-dotnet.zip
Then, I ran dotnet restore. This creates the project.assets.json file, which is read by Component-Detection.
To be sure Component-Detection works as expected, I used .\componentdetection.exe scan --SourceDirectory . --SourceFileRoot . --ManifestFile componentdetection_manifest.json. This generated the file componentdetection_manifest.json. In this file, the dependencies are stored as a graph, not a flat list where all dependencies point to the root package:
But when executing .\sbom.exe Generate -b . -bc . -ps "MyTest" -pn "MyPackageName" -pv "1.0.0", this hierarchy is not kept in the resulting spdx file: manifest.spdx.json
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by comparing the dependency relationships in project.assets.json and componentdetection_manifest.json with those in manifest.spdx.json produced by the shown sbom Generate command. Trace how the .NET Solution dependency data is transferred into the SPDX output; done means the resulting relationships preserve the subdependency graph rather than pointing every dependency to SPDXRef-RootPackage.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- devtools, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100