Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Set additional properties when generating sbom for nugets #842

Open
thompson-tomo opened this issue Jan 28, 2024 · 3 comments · May be fixed by #846
Open

Set additional properties when generating sbom for nugets #842

thompson-tomo opened this issue Jan 28, 2024 · 3 comments · May be fixed by #846
Labels
enhancement New feature or request stale

Comments

@thompson-tomo
Copy link

thompson-tomo commented Jan 28, 2024

When generating a SBOM the below properties should be set to provide a richer experience & better information.

  • Group the first segment of the package name
  • publisher is the owner as specified in Nuget (nuspecmodel), if empty use author
  • releasenotes as specified in Nuget (nuspecmodel)
  • properties with a property for the language of the package
  • properties with a property for the tags of the package
  • supplier the url/name of the repository used to source package. This would need to come from package source mapping. will be handled via Utilize package mapping to source additional information #845
@github-actions github-actions bot added the triage Don't know what to do with this yet label Jan 28, 2024
@mtsfoni
Copy link
Contributor

mtsfoni commented Jan 29, 2024

Group the first segment of the package name

This bases on the assumption that packages are named by a certain convention/best practice that is not enforced. I don't think that this applies to all packages.

publisher is the owner as specified in Nuget, if empty use author

Sounds not unreasonable. Interestingly though, on the NuGet website you usually see an owner e.g. here, but in the .nuspec-file I didn't see a filled owner node yet.
I would really love using the one from the .nuspec-file but I am little hesitant having to parse the NuGet website for that information. Which did you mean with "as specified in Nuget"?

@mtsfoni mtsfoni added enhancement New feature or request and removed triage Don't know what to do with this yet labels Jan 29, 2024
thompson-tomo added a commit to thompson-tomo/cyclonedx-dotnet that referenced this issue Jan 29, 2024
@thompson-tomo thompson-tomo linked a pull request Jan 29, 2024 that will close this issue
thompson-tomo added a commit to thompson-tomo/cyclonedx-dotnet that referenced this issue Jan 29, 2024
@thompson-tomo
Copy link
Author

@mtsfoni i have just pushed a draft PR #846 which shows the publisher being set.

In relation to the Group you are correct it is not enforced but recently nuget has started using verified prefixes to help improve security by providing visual indicator that packages are coming from a reputable source and who they claim to be.

thompson-tomo added a commit to thompson-tomo/cyclonedx-dotnet that referenced this issue Jan 30, 2024
thompson-tomo added a commit to thompson-tomo/cyclonedx-dotnet that referenced this issue Jan 30, 2024
thompson-tomo added a commit to thompson-tomo/cyclonedx-dotnet that referenced this issue Jan 30, 2024
thompson-tomo added a commit to thompson-tomo/cyclonedx-dotnet that referenced this issue Jan 30, 2024
Copy link

github-actions bot commented May 5, 2024

This issue is stale because it has been open for 3 months with no activity.

@github-actions github-actions bot added the stale label May 5, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request stale
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants