Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

BOM should include Framework Components #836

Open
thompson-tomo opened this issue Jan 21, 2024 · 7 comments
Open

BOM should include Framework Components #836

thompson-tomo opened this issue Jan 21, 2024 · 7 comments
Labels
enhancement New feature or request

Comments

@thompson-tomo
Copy link

The BOM generated by the tool should also include:

  • Framework Component for each TargetFramework and the version is based upon what is installed
  • Library Component for both implicit and explicit FrameworkReferences and the version is based upon what is installed.
@github-actions github-actions bot added the triage Don't know what to do with this yet label Jan 21, 2024
@mtsfoni
Copy link
Contributor

mtsfoni commented Jan 29, 2024

Basically waiting for the outcome of this:
Feature: documenting external/extraneous dependencies

@mtsfoni mtsfoni added enhancement New feature or request and removed triage Don't know what to do with this yet labels Jan 29, 2024
@lhotamir
Copy link

This would be really useful, because now it is kinda difficult to monitor vulnerabilities in the framework itself.

@thompson-tomo
Copy link
Author

@mtsfoni As nuspec provides the framework dependence needed by the package & I wouldn't want to lose that association information. Could we as a first step add those dependencies as an optional component.

Reason I am wanting to go down this path as when an application is published as trimmed + self contained those dependencies become required. We could Potentially have an argument able to be passed to the tool to signify compilation mode ie dependent, self contained or trimmed which alters the scope of the dependencies.

Copy link

github-actions bot commented May 5, 2024

This issue is stale because it has been open for 3 months with no activity.

@github-actions github-actions bot added the stale label May 5, 2024
@berezovskyi
Copy link

berezovskyi commented Jun 28, 2024

Basically waiting for the outcome of this:
CycloneDX/specification#321

This is not the case when producing self-contained dotnet builds. In that case, the dotnet runtime is delivered as part of the application and is not an extraneous component. Any (security) upgrades to the OS-installed frameworks are ignored by a self-contained application. Thus, the SBOM should reflect this so that SBOM consumers do not mistakenly believe that they can install the new version of the dotnet framework OS-wide and that self-contained dotnet applications would have all framework security issues addressed by the update.

@github-actions github-actions bot removed the stale label Jun 30, 2024
Copy link

This issue is stale because it has been open for 3 months with no activity.

@github-actions github-actions bot added the stale label Sep 29, 2024
@thompson-tomo
Copy link
Author

Still waiting

@github-actions github-actions bot removed the stale label Oct 6, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

4 participants