microsoft / microsoft/sbom-tool

SBOM Task Outputs Directly to Console Instead of Using MSBuild Logging APIs

Open
#712 6 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

.NET
Dominant language
C#
Stars
2.1k
Forks
201
Avg merge
6d 21h
Merged PRs (30d)
1

Description

When using the SBOM task in an MSBuild project, the task outputs messages directly to the console rather than utilizing MSBuild's Logging APIs. This behavior results in cluttered and unstructured console output, which is not consistent with standard MSBuild practices. Proper logging through MSBuild's APIs would allow for better categorization and filtering of messages.

Steps to Reproduce:

  1. Create a .NET project and include the SBOM task.
  2. Run the command dotnet pack -bl to build the project with a binary log.
  3. Observe the console output during the build process.

Expected behavior:

Sbom task should output messages through MSBuild logging APIs & categorized appropriately.

We can utilize TaskLoggingHelper:

public class SbomTask : Microsoft.Build.Utilities.Task
{
    public override bool Execute()
    {
        // Example of logging an informational message
        Log.LogMessage(MessageImportance.High, "Finding components...");
        // Example of logging a warning
        Log.LogWarning("No instructions received to scan docker images.");
        // Example of logging an error
        Log.LogError("An error occurred during SBOM generation.");

        // Rest of the task implementation

        return !Log.HasLoggedErrors;
    }
}

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the SbomTask and the code paths that write messages directly to the console. Run the reported dotnet pack -bl reproduction and inspect the console and binary log. Done means SBOM messages use MSBuild logging APIs and are appropriately categorized.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
build-system
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.