search

patriksvensson / covenant

A tool to generate SBOM (Software Bill of Material) from source code artifacts.
MIT License
60 stars 6 forks source link

Usage with .NET 8 projects using the 'UseArtifactsOutput' build option #15

Open Numpsy opened 7 months ago

Numpsy commented 7 months ago

Hi,

I had a go at running Covenant on a project that uses the 'UseArtifactsOutput' build option that was added in .NET 8 (which causes all the 'obj' directories to get put under a single 'artifacts' directory under the build root), and that failed as it couldn't find the project.assets.json file.

I haven't had much of a look at the issue, but I guess it might be down to https://github.com/patriksvensson/covenant/blob/afaa6d6b83d00f9cbe8005f2091f521cb4a4dbfd/src/Covenant/Analysis/Dotnet/DotnetAnalyzer.cs#L223C38-L223C38 which looks for the assets file in a fixed location under the directory containing the project file.

patriksvensson commented 7 months ago

Yes, that's probably why it can't find it.

Numpsy commented 7 months ago

I'm not sure offhand what the best way to get the 'real' path from the project tools (Buildalyzer or Microsoft.Build.* etc) is. Using the .NET 8 SDK you can do things like

dotnet build --getProperty:BaseIntermediateOutputPath

to get the path, but that won't work with older sdks.

Numpsy commented 6 months ago

It looks like you can get the path to the assets file by doing the design time build and getting the ProjectAssetsFile property from the results. However, it currently does a design time build based on data in the assets file and doesn't do it if it can't read the assets, so I think it'd need reworking a bit to do that.

I also tried making it execute dotnet build --getProperty:ProjectAssetsFile and read the output and that seems to work as well, though it's working with external processes rather than library calls.