Merge branch 'v3' into refactorProgramClass

CycloneDX · Dec 14, 2023 · 75d2384 · 75d2384
2 parents fc76c9b + 291333d
commit 75d2384
Show file tree

Hide file tree

Showing 11 changed files with 33 additions and 10 deletions.
diff --git a/.devcontainer/Ubuntu22.04/Dockerfile b/.devcontainer/Ubuntu22.04/Dockerfile
@@ -4,5 +4,5 @@ RUN apt-get install -y --no-install-recommends wget=2.0.1
 RUN apt-get install -y --no-install-recommends apt-transport-https=2.5.6
 RUN curl -o ./packages-microsoft-prod.deb https://packages.microsoft.com/config/ubuntu/22.04/packages-microsoft-prod.deb
 RUN dpkg -i packages-microsoft-prod.deb
-RUN apt-get install -y --no-install-recommends dotnet-sdk-7.0=7.0
+RUN apt-get install -y --no-install-recommends dotnet-sdk-8.0=8.0
 RUN rm -rf /var/lib/apt/lists/*
diff --git a/.github/workflows/dotnetcore.yml b/.github/workflows/dotnetcore.yml
@@ -21,7 +21,7 @@ jobs:
         uses: actions/setup-dotnet@v3
         with:
           dotnet-version: |
-            7.x
+            8.x
       - name: Build
         run: dotnet build /WarnAsError
 
@@ -43,11 +43,15 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]
-        framework: ['net6.0','net7.0']
+        framework: ['net6.0','net7.0', 'net8.0']
     timeout-minutes: 30
 
     steps:
       - uses: actions/checkout@v4
+      - name: Setup dotnet 8
+        uses: actions/[email protected]
+        with:
+          dotnet-version: '8.x'
       - name: Setup dotnet 7
         uses: actions/setup-dotnet@v3
         with:

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -33,11 +33,11 @@ jobs:
         uses: actions/[email protected]
         with:
           dotnet-version: |
-            7.x
+            8.x
 
       # The tests should have already been run during the PR workflow, so this is really just a sanity check
       - name: Tests
-        run: dotnet test --framework net7.0
+        run: dotnet test --framework net8.0
 
       # Build and package everything, including the Docker image
       - name: Package release

diff --git a/.gitignore b/.gitignore
@@ -15,4 +15,4 @@ SBOM/
 .nuget/
 .opencode-server/
 TestResults/
-/CycloneDX/Properties/launchSettings.json
+CycloneDX/Properties/launchSettings.json
diff --git a/.gitpod.yml b/.gitpod.yml
@@ -10,6 +10,7 @@ tasks:
       "$DOTNET_ROOT/dotnet-install.sh" --channel 2.1 --install-dir "$DOTNET_ROOT"
       "$DOTNET_ROOT/dotnet-install.sh" --channel 6.0 --install-dir "$DOTNET_ROOT"
       "$DOTNET_ROOT/dotnet-install.sh" --channel 7.0 --install-dir "$DOTNET_ROOT"
+      "$DOTNET_ROOT/dotnet-install.sh" --channel 8.0 --install-dir "$DOTNET_ROOT"
       dotnet tool install --global dotnet-reportgenerator-globaltool
       dotnet restore
 

diff --git a/CycloneDX.Tests/CycloneDX.Tests.csproj b/CycloneDX.Tests/CycloneDX.Tests.csproj
@@ -4,7 +4,7 @@
 
     <IsTestProject>true</IsTestProject>
     <IsPackable>false</IsPackable>
-    <TargetFrameworks>net7.0;net6.0</TargetFrameworks>
+    <TargetFrameworks>net8.0;net7.0;net6.0</TargetFrameworks>
     <LangVersion>latest</LangVersion>
   </PropertyGroup>
 

diff --git a/CycloneDX/CycloneDX.csproj b/CycloneDX/CycloneDX.csproj
@@ -9,7 +9,7 @@
     <GeneratePackageOnBuild>true</GeneratePackageOnBuild>
     <ToolCommandName>dotnet-CycloneDX</ToolCommandName>
     <_SkipUpgradeNetAnalyzersNuGetWarning>true</_SkipUpgradeNetAnalyzersNuGetWarning>
-    <TargetFrameworks>net7.0;net6.0</TargetFrameworks>
+    <TargetFrameworks>net8.0;net7.0;net6.0</TargetFrameworks>
   </PropertyGroup>
 
   <PropertyGroup Condition="'$(OsEnvironment )'=='windows'">

diff --git a/CycloneDX/Services/ProjectAssetsFileService.cs b/CycloneDX/Services/ProjectAssetsFileService.cs
@@ -84,6 +84,23 @@ public HashSet<NugetPackage> GetNugetPackages(string projectFilePath, string pro
                         runtimePackages.Add(package);
                     }
 
+                    var allDependencies = runtimePackages.SelectMany(y => y.Dependencies.Keys).Distinct();
+                    var allPackages = runtimePackages.Select(p => p.Name);
+                    var packagesNotInAllPackages = allDependencies.Except(allPackages);
+
+                    // Check if there is an "unresolved" dependency on NetStandard                    
+                    if (packagesNotInAllPackages.Any(p => p == "NETStandard.Library"))
+                    {
+                        // If a project library has targets .net standard it actually doesn't resolve this dependency
+                        // instead it is expected to find the Standard-Libraries on the target system
+                        // => the libraries not being part of the resulting application and thus should not be included in
+                        // the sbom anyways
+                        foreach (var item in runtimePackages)
+                        {
+                            item.Dependencies.Remove("NETStandard.Library");
+                        }
+                    }
+
                     ResolveDependencyVersionRanges(runtimePackages);
 
                     packages.UnionWith(runtimePackages);

diff --git a/Dockerfile b/Dockerfile
@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/dotnet/sdk:7.0
+FROM mcr.microsoft.com/dotnet/sdk:8.0
 
 ARG VERSION
 COPY ./nupkgs /tmp/nupkgs/

diff --git a/README.md b/README.md
@@ -15,6 +15,7 @@ The CycloneDX module for .NET creates a valid CycloneDX bill-of-material documen
 This module runs on 
 *   .NET 6.0
 *   .NET 7.0
+*   .NET 8.0
 
 This module no longer runs on
 

diff --git a/semver.txt b/semver.txt
@@ -1 +1 @@
-2.9.0
+2.10.0