microsoft / microsoft/sbom-tool
SBOM Task Outputs Directly to Console Instead of Using MSBuild Logging APIs
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 2.1k
- Forks
- 201
- Avg merge
- 6d 21h
- Merged PRs (30d)
- 1
Description
When using the SBOM task in an MSBuild project, the task outputs messages directly to the console rather than utilizing MSBuild's Logging APIs. This behavior results in cluttered and unstructured console output, which is not consistent with standard MSBuild practices. Proper logging through MSBuild's APIs would allow for better categorization and filtering of messages.
Steps to Reproduce:
- Create a .NET project and include the SBOM task.
- Run the command
dotnet pack -blto build the project with a binary log. - Observe the console output during the build process.
Expected behavior:
Sbom task should output messages through MSBuild logging APIs & categorized appropriately.
We can utilize TaskLoggingHelper:
public class SbomTask : Microsoft.Build.Utilities.Task
{
public override bool Execute()
{
// Example of logging an informational message
Log.LogMessage(MessageImportance.High, "Finding components...");
// Example of logging a warning
Log.LogWarning("No instructions received to scan docker images.");
// Example of logging an error
Log.LogError("An error occurred during SBOM generation.");
// Rest of the task implementation
return !Log.HasLoggedErrors;
}
}
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the SbomTask and the code paths that write messages directly to the console. Run the reported dotnet pack -bl reproduction and inspect the console and binary log. Done means SBOM messages use MSBuild logging APIs and are appropriately categorized.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- build-system
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100