Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Set additional properties when generating sbom for nugets #842

Open
thompson-tomo opened this issue Jan 28, 2024 · 3 comments · May be fixed by #846
Open

Set additional properties when generating sbom for nugets #842

thompson-tomo opened this issue Jan 28, 2024 · 3 comments · May be fixed by #846
Labels
enhancement New feature or request stale

Comments

@thompson-tomo
Copy link

thompson-tomo commented Jan 28, 2024 •
edited

When generating a SBOM the below properties should be set to provide a richer experience & better information.

  • Group the first segment of the package name
  • publisher is the owner as specified in Nuget (nuspecmodel), if empty use author
  • releasenotes as specified in Nuget (nuspecmodel)
  • properties with a property for the language of the package
  • properties with a property for the tags of the package
  • supplier the url/name of the repository used to source package. This would need to come from package source mapping. will be handled via Utilize package mapping to source additional information #845
@github-actions github-actions bot added the triage Don't know what to do with this yet label Jan 28, 2024
@thompson-tomo thompson-tomo mentioned this issue Jan 28, 2024
Open
@mtsfoni
Copy link
Contributor

mtsfoni commented Jan 29, 2024

Group the first segment of the package name

This bases on the assumption that packages are named by a certain convention/best practice that is not enforced. I don't think that this applies to all packages.

publisher is the owner as specified in Nuget, if empty use author

Sounds not unreasonable. Interestingly though, on the NuGet website you usually see an owner e.g. here, but in the .nuspec-file I didn't see a filled owner node yet.
I would really love using the one from the .nuspec-file but I am little hesitant having to parse the NuGet website for that information. Which did you mean with "as specified in Nuget"?

@mtsfoni mtsfoni added enhancement New feature or request and removed triage Don't know what to do with this yet labels Jan 29, 2024
thompson-tomo added a commit to thompson-tomo/cyclonedx-dotnet that referenced this issue Jan 29, 2024
@thompson-tomo
CycloneDX#842 set Publisher to owner if available otherwise author
1c32c0e
@thompson-tomo thompson-tomo linked a pull request Jan 29, 2024 that will close this issue
Open
thompson-tomo added a commit to thompson-tomo/cyclonedx-dotnet that referenced this issue Jan 29, 2024
@thompson-tomo
CycloneDX#842 set Publisher to owner if available otherwise author
db5775b 
Signed-off-by: James Thompson <thompson.tomo@outlook.com>
@thompson-tomo
Copy link
Author

@mtsfoni i have just pushed a draft PR #846 which shows the publisher being set.

In relation to the Group you are correct it is not enforced but recently nuget has started using verified prefixes to help improve security by providing visual indicator that packages are coming from a reputable source and who they claim to be.

thompson-tomo added a commit to thompson-tomo/cyclonedx-dotnet that referenced this issue Jan 30, 2024
@thompson-tomo
CycloneDX#842 Added in the release notes
da4a179
thompson-tomo added a commit to thompson-tomo/cyclonedx-dotnet that referenced this issue Jan 30, 2024
@thompson-tomo
CycloneDX#842 add in properties for metadata etc
bc9818c
thompson-tomo added a commit to thompson-tomo/cyclonedx-dotnet that referenced this issue Jan 30, 2024
@thompson-tomo
CycloneDX#842 Added in the release notes
0636839 
Signed-off-by: James Thompson <thompson.tomo@outlook.com>
thompson-tomo added a commit to thompson-tomo/cyclonedx-dotnet that referenced this issue Jan 30, 2024
@thompson-tomo
CycloneDX#842 add in properties for metadata etc
6aedc89 
Signed-off-by: James Thompson <thompson.tomo@outlook.com>
@github-actions GitHub Actions
Copy link

github-actions bot commented May 5, 2024

This issue is stale because it has been open for 3 months with no activity.

@github-actions github-actions bot added the stale label May 5, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement New feature or request stale
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

#842 Add additional properties to SBOM thompson-tomo/cyclonedx-dotnet
2 participants
@thompson-tomo @mtsfoni