Open Sebazzz opened 7 months ago
We have the same issue. Does component gov not support central package management (NuGet)?
Hello @Sebazzz
I am not able to reproduce the issue. I tried your configuration using the latest version of component detection v4.2.1 and the right components are detected. I also tried running the latest version of the sbom-tool v2.2.3 and also the correct components were reported. These are the files that I used:
csproj
<Project Sdk="Microsoft.NET.Sdk">
<PropertyGroup>
<OutputType>Exe</OutputType>
<TargetFramework>net8.0</TargetFramework>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
</PropertyGroup>
<ItemGroup>
<PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer"/>
<PackageReference Include="Microsoft.Data.SqlClient" />
<PackageReference Include="Newtonsoft.Json" />
</ItemGroup>
</Project>
Directory.Packages.Props
<?xml version="1.0" encoding="utf-8"?>
<Project>
<!-- Central registry of all packages used in the project -->
<!-- See: https://devblogs.microsoft.com/nuget/introducing-central-package-management/ -->
<PropertyGroup>
<ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
<CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
</PropertyGroup>
<ItemGroup>
<PackageVersion Include="Microsoft.Data.SqlClient" Version="5.1.4" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="8.0.0" />
<PackageVersion Include="Microsoft.IdentityModel.JsonWebTokens" Version="7.2.0" />
<PackageVersion Include="System.IdentityModel.Tokens.Jwt" Version="7.2.0" />
<PackageVersion Include="Newtonsoft.Json" Version="12.0.3" />
</ItemGroup>
</Project>
This is the manifest generated by sbom
I'm using Central Package Management to manage my NuGet versions centrally, and also pin subdependencies to higher versions, for instance to mitigate vulnerable transitive dependencies.
I pinned
System.IdentityModel.Tokens.Jwt
because it had a vulnerability, which is used byMicrosoft.IdentityModel.Protocols.OpenIdConnect
, which is used byMicrosoft.Data.SqlClient
, which is used byMicrosoft.EntityFrameworkCore.SqlServer
which I directly reference.I'm using the
sbom-tool
to generate my SBOM, and the scan manifest shows:Interestingly, in a different project in the same solution the dependency version is correctly detected, but the project mentioned above also shows up here:
AB#2139506