Skip to content

Microsoft.Sbom.Adapters missing an adapter for new component detection component 'dotnet' #972

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
pgunasekara opened this issue Mar 12, 2025 · 9 comments
Labels
accepted We are working on this and hope to release it into the product

Comments

@pgunasekara
Copy link
Member

Component detection recently added a component named 'dotnet': microsoft/component-detection@255e011

A matching adapter is missing in https://github.com/microsoft/sbom-tool/tree/main/src/Microsoft.Sbom.Adapters/Adapters/ComponentDetection

This is resulting in the following error:

Unable to parse bcde-output.json at path 'd:\dbs\sh\bxlint\0310_150811\Logs\ComponentGovernance\bcde-output\bcde-output.json' due to the following exception: Newtonsoft.Json.JsonSerializationException: Error converting value "DotNet" to type 'Microsoft.ComponentDetection.Contracts.TypedComponent.ComponentType'. Path 'detectorsInScan[1].supportedComponentTypes[0]', line 40732, position 16.
---> System.ArgumentException: Requested value 'DotNet' was not found.
   at Microsoft.Sbom.Adapters.ComponentDetectionToSBOMPackageAdapter.TryConvert(String bcdeOutputPath) in D:\a\_work\1\s\src\Microsoft.Sbom.Adapters\ComponentDetectionToSBOMPackageAdapter.cs:line 37
pgunasekara added a commit to microsoft/BuildXL that referenced this issue Mar 13, 2025
Update packages: Microsoft.ComponentDetection.Contracts 5.2.6 -> 5.2.7

Reverts !831693

Reverting due to this bug on the sbom tool repo: microsoft/sbom-tool#972
@DaveTryon DaveTryon added the needs triage Default status upon issue submission label Mar 19, 2025
@sfoslund sfoslund added accepted We are working on this and hope to release it into the product and removed needs triage Default status upon issue submission labels Mar 19, 2025
@DaveTryon
Copy link
Contributor

This shouldn't be impacting the shipping code yet, since we're using component-detection 5.2.1 and the change went into component-detection 5.2.10. We've created an internal feature at https://dev.azure.com/mseng/1ES/_workitems/edit/2261796 to track this change to make sure that we don't bump the CD version without making this change.

@pgunasekara
Copy link
Member Author

@DaveTryon Would you happen to know when the next release of nuget packages containing this change would be released?

@pgunasekara
Copy link
Member Author

@DaveTryon / @sfoslund wanted to ping you again on this in case you hadn't seen it. Would you be able to tell me when the next release might be? I ask because we want to pick the latest component detection packages for buildxl/cloudbuild/quickbuild, but this bug would block us from doing so.

@sfoslund
Copy link
Member

Hi @pgunasekara, I will bring this up with the wider team this week and get back to you with an update

@sfoslund
Copy link
Member

Looks like this was fixed in #994 and will be included in our next release, and we are planning on releasing a new version early next week.

@pgunasekara
Copy link
Member Author

Hey @sfoslund just wanted to check in whether a release was still happening. Not trying to rush you, just checking so I can report back to my team.

@sfoslund
Copy link
Member

Yes, apologies for the delay, @DaveTryon has been actively working on the release and it should go out early this week

@pgunasekara
Copy link
Member Author

Hey @sfoslund just checking in again to give my team a status update on when we might be able to update CG on Cloudbuild. Thanks!

@sfoslund
Copy link
Member

Hi @pgunasekara sorry for the delay, as you can see the new version is out now! Does the new release address this issue? Can we close here?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
accepted We are working on this and hope to release it into the product
Projects
None yet
Development

No branches or pull requests

3 participants