CycloneDX / cyclonedx-dotnet

Creates CycloneDX Software Bill of Materials (SBOM) from .NET Projects
https://cyclonedx.org/
Apache License 2.0
178 stars 84 forks source link

Exclude developer dependencies is not reflecting real runtime dependencies #847

Open gotztibor opened 7 months ago

gotztibor commented 7 months ago

The NuGet package assets are not considered correctly when developer dependencies are excluded.

The following assets are considered to have "runtime" dependency:

Upon generating the dependencies without the developer dependencies (only availabe at build, but not at runtime) the dependencies are not calculated correctly.

Example project file:

<Project Sdk="Microsoft.NET.Sdk">

  <PropertyGroup>
    <TargetFramework>net8.0</TargetFramework>
    <OutputType>exe</OutputType>
  </PropertyGroup>

  <ItemGroup>
    <!-- runtime true -->
    <PackageReference Include="Google.Protobuf" Version="3.25.2" PrivateAssets="analyzers;build" />
    <!-- runtime true with transitive dependencies -->
    <PackageReference Include="log4net" Version="2.0.15" ExcludeAssets="none" />
    <!-- runtime false, without transitive dependencies -->
    <PackageReference Include="Microsoft.Extensions.Logging" Version="8.0.0" ExcludeAssets="all" />
    <!-- runtime true -->
    <PackageReference Include="Newtonsoft.Json" Version="13.0.3" IncludeAssets="runtime" ExcludeAssets="native;contentFiles;build" />
    <!-- runtime true -->
    <PackageReference Include="Serilog" Version="3.1.1" PrivateAssets="all" IncludeAssets="runtime" />
  </ItemGroup>

</Project>

Expected outcome: As the Microsoft.Extensions.Logging is excluded fully, this will be just a developer dependency, and also it's transitive dependencies must not be shown as well. Also the build output folder and the default publish folder and the possibly generated NuGets package are not containing those NuGets and not referencing them.

gotztibor commented 7 months ago

Please see Pull Request 848

github-actions[bot] commented 4 months ago

This issue is stale because it has been open for 3 months with no activity.