AssemblyAnalyzer (at least on Mac OS x64) runs into "The 'dotnet' executable could not be found on the path"

[aikebah]

Describe the bug
AssemblyAnalyzer (at least on Mac OS x64) runs into "The 'dotnet' executable could not be found on the path" when dotnet executable is available on the system path.

Version of dependency-check used
The problem occurs using version 7.3.2 of the maven plugin, but due to its root cause will apply to all integrations

Log file

[ERROR] ----------------------------------------------------
[ERROR] .NET Assembly Analyzer could not be initialized and at least one 'exe' or 'dll' was scanned. The 'dotnet' executable could not be found on the path; either disable the Assembly Analyzer or add the path to dotnet core in the configuration.
[ERROR] ----------------------------------------------------

To Reproduce
Steps to reproduce the behavior:

1. Install a current dotnet 6.0 core runtime
2. Scan a project with a dll or exe
3. See the error reported eventhough dotnet is in the path

Expected behavior
.NET Assembly Analyzer successfully detecting the presence of the dotnet executable in the path.

Additional context
From console output it can be established that the old way of working (dotnet --version) no longer works for at least dotnet 6 core runtime on Mac OS. It appears to nowadays require dotnet --info to get a clean returncode

aikebah@abu suppressions % dotnet --version
The command could not be loaded, possibly because:
  * You intended to execute a .NET application:
      The application '--version' does not exist.
  * You intended to execute a .NET SDK command:
      No .NET SDKs were found.

Download a .NET SDK:
https://aka.ms/dotnet-download

Learn about SDK resolution:
https://aka.ms/dotnet/sdk-not-found
aikebah@abu suppressions % echo $?
145
aikebah@abu suppressions % dotnet --info

global.json file:
  Not found

Host:
  Version:      6.0.11
  Architecture: x64
  Commit:       943474ca16

.NET SDKs installed:
  No SDKs were found.

.NET runtimes installed:
  Microsoft.AspNetCore.App 6.0.2 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 6.0.2 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 6.0.9 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 6.0.11 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]

Download .NET:
  https://aka.ms/dotnet-download

Learn about .NET Runtimes and SDKs:
  https://aka.ms/dotnet/runtimes-sdk-info
aikebah@abu suppressions % echo $?
0

[aikebah]

Behavior depends on whether or not a dotnet SDK is installed or only the runtime. --version reaches out to the SDK. see also dotnet/dotnet-docker#2235 and dotnet/sdk#6569

[jeremylong]

I suppose we check both version and info?

[aikebah]

From what I get --info would suffice. The code just checks whether the executable is on the path (if no explicit executable is configured) by calling dotnet --version checking for succesful invocation and discarding any output created. If that fails the assembly analyzer gets disabled.

But if I understand correctly it would require only dotnet runtime, not the full sdk. Both setups support dotnet --info from what I understand from the linked issues, but only an install including SDK supports dotnet --version