search

CycloneDX / cyclonedx-dotnet

Creates CycloneDX Software Bill of Materials (SBOM) from .NET Projects
https://cyclonedx.org/
Apache License 2.0
167 stars 78 forks source link

Utilize package mapping to source additional information #845

Open thompson-tomo opened 5 months ago

thompson-tomo commented 5 months ago

This issue is a continuation of #842

With the introduction of package source mapping (https://devblogs.microsoft.com/nuget/introducing-package-source-mapping/) it should now be possible for cyclonedx to determine who the supplier of the nuget package is.

The idea is to read the package source mapping and then set the supplier accordingly.

Assumptions Nuget.Config file exists within either the project directory or the solution direction.

github-actions[bot] commented 2 months ago

This issue is stale because it has been open for 3 months with no activity.