search

CycloneDX / cyclonedx-dotnet

Creates CycloneDX Software Bill of Materials (SBOM) from .NET Projects
https://cyclonedx.org/
Apache License 2.0
178 stars 84 forks source link

843 scope property is always being set to required #844

Open mtsfoni opened 8 months ago

thompson-tomo commented 8 months ago

@mtsfoni will this fix also result in dependencies of the dev dependency also having their scope classified as excluded as I am needing that fixed as part of this.

mtsfoni commented 8 months ago

You are right, it doesn't. That also seems a little trickier as the asset file, doesn't give the information directly.

Looks like I'd have to check the dependency graph and can mark one of those a dev dependency if every path towards the root include at least one dev dependency in-between.

Here D would be a dev dependency:

  B (dev) - D
 /
A

Here D cannot be a dev dependency:

  B (dev) - D
 /
A -  C  - D

Here, however, D would be a dev dependency again (all paths to A have a dev dependency on the way): 

  B (dev) - D
 /
A -  C (dev) - D

@thompson-tomo do you happen to know a package in the gallery that will automatically be added as development dependency and has dependencies by itself? Most of those package have no dependencies by themselves.

thompson-tomo commented 8 months ago

I agree, it isn't as easy as would be hoped. So the main dev dependency package i am looking for a solution for would be Microsoft.VisualStudio.Web.CodeGeneration.Design & Microsoft.EntityFrameworkCore.Tools i am fairely sure atleast one of them is automatically added as a dev dependency,

mtsfoni commented 8 months ago

I will certainly solve this, as I consider it a bug. But I need to shift some things around in the process to make it work, so this is bigger task.

mtsfoni commented 7 months ago

@mtsfoni will this fix also result in dependencies of the dev dependency also having their scope classified as excluded as I am needing that fixed as part of this.

Question: Do you need them specifically to be scope.excluded or is it also fine, if they just don't appear in the sbom at all? I learned that scope.excluded actually is meant for components that are necessary to use the software, but are not included in the scope of delivery.

thompson-tomo commented 7 months ago

Question: Do you need them specifically to be scope.excluded or is it also fine, if they just don't appear in the sbom at all? I learned that scope.excluded actually is meant for components that are necessary to use the software but are not included in the scope of delivery.

I don't specificially need the scope to be set to excluded and my comment was in response to the changes you had pushed. Happy for them to simply not appear in the SBOM especially if it makes things easier to fix.