Skip to content

Commit 80c43d9

Browse files
mcombuechensnyk-tim
mcombuechen
and
snyk-tim
committed
fix: bugfixes for SBOM generation (snyk sbom)
Fixes issues when generating an SBOM document for NuGet .sln files. Also displays more detailed error messages in case the software composition analysis fails during SBOM generation. Co-Authored-By: Max Combüchen <[email protected]> Co-Authored-By: Tim Pickles <[email protected]>
1 parent 0eeb032 commit 80c43d9

13 files changed

+1639
-16
lines changed

‎cliv2/go.mod

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,11 +10,11 @@ require (
1010
github.com/google/uuid v1.6.0
1111
github.com/pkg/errors v0.9.1
1212
github.com/rs/zerolog v1.33.0
13-
github.com/snyk/cli-extension-dep-graph v0.0.0-20241014075215-311d3c8a423f
13+
github.com/snyk/cli-extension-dep-graph v0.0.0-20250321153619-9390ab5e348e
1414
github.com/snyk/cli-extension-iac-rules v0.0.0-20250227121450-6e14346dbd1a
1515
github.com/snyk/cli-extension-sbom v0.0.0-20241016065306-0df2be5b3b8f
1616
github.com/snyk/container-cli v0.0.0-20240821111304-7ca1c415a5d7
17-
github.com/snyk/error-catalog-golang-public v0.0.0-20250218074309-307ad7b38a60
17+
github.com/snyk/error-catalog-golang-public v0.0.0-20250310083934-7ac627e3451f
1818
github.com/snyk/go-application-framework v0.0.0-20250325133828-3ffd1aa4f76f
1919
github.com/snyk/go-httpauth v0.0.0-20240307114523-1f5ea3f55c65
2020
github.com/snyk/snyk-iac-capture v0.6.5
@@ -217,15 +217,15 @@ require (
217217
go.uber.org/multierr v1.11.0 // indirect
218218
golang.org/x/crypto v0.36.0 // indirect
219219
golang.org/x/exp v0.0.0-20250215185904-eff6e970281f // indirect
220-
golang.org/x/mod v0.23.0 // indirect
220+
golang.org/x/mod v0.24.0 // indirect
221221
golang.org/x/net v0.37.0 // indirect
222222
golang.org/x/oauth2 v0.27.0 // indirect
223223
golang.org/x/sync v0.12.0 // indirect
224224
golang.org/x/sys v0.31.0 // indirect
225225
golang.org/x/term v0.30.0 // indirect
226226
golang.org/x/text v0.23.0 // indirect
227227
golang.org/x/time v0.8.0 // indirect
228-
golang.org/x/tools v0.30.0 // indirect
228+
golang.org/x/tools v0.31.0 // indirect
229229
google.golang.org/api v0.215.0 // indirect
230230
google.golang.org/genproto v0.0.0-20241118233622-e639e219e697 // indirect
231231
google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576 // indirect

‎cliv2/go.sum

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -796,8 +796,8 @@ github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ
796796
github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
797797
github.com/skeema/knownhosts v1.3.1 h1:X2osQ+RAjK76shCbvhHHHVl3ZlgDm8apHEHFqRjnBY8=
798798
github.com/skeema/knownhosts v1.3.1/go.mod h1:r7KTdC8l4uxWRyK2TpQZ/1o5HaSzh06ePQNxPwTcfiY=
799-
github.com/snyk/cli-extension-dep-graph v0.0.0-20241014075215-311d3c8a423f h1:xZK+6ug+pNgnIfPFGkQtxBZwcN/6RoXpQruRHimjfKM=
800-
github.com/snyk/cli-extension-dep-graph v0.0.0-20241014075215-311d3c8a423f/go.mod h1:QF3v8HBpOpyudYNCuR8LqfULutO76c91sBdLzD+pBJU=
799+
github.com/snyk/cli-extension-dep-graph v0.0.0-20250321153619-9390ab5e348e h1:lYBeDqyAmb7NPfcLZJb1rcc+BrWhX5Ct9isQO1O4mSc=
800+
github.com/snyk/cli-extension-dep-graph v0.0.0-20250321153619-9390ab5e348e/go.mod h1:9Zpe+B8SCkWFjpDR3ckFJl1XuMyxysWebKhyAIj7EyI=
801801
github.com/snyk/cli-extension-iac-rules v0.0.0-20250227121450-6e14346dbd1a h1:SJ+Ts7e1EYcGJXeENR5inTGwPNRlNVgmMN2itO3+yj8=
802802
github.com/snyk/cli-extension-iac-rules v0.0.0-20250227121450-6e14346dbd1a/go.mod h1:IqfQCIkyC26mkwa+aM6d6yxIh5+tCm4fSQG+Ogq3Qbc=
803803
github.com/snyk/cli-extension-sbom v0.0.0-20241016065306-0df2be5b3b8f h1:dlL+f+5sjHj4JCzW/Evl1x9UREXLyc3M4KjoZvQx0Bs=
@@ -806,8 +806,8 @@ github.com/snyk/code-client-go v1.17.1 h1:H5G4Ufe8fMkLpr9L//34S2iXdfRY7Q/+gALedI
806806
github.com/snyk/code-client-go v1.17.1/go.mod h1:WH6lNkJc785hfXmwhixxWHix3O6z+1zwz40oK8vl/zg=
807807
github.com/snyk/container-cli v0.0.0-20240821111304-7ca1c415a5d7 h1:Zn5BcV76oFAbJm5tDygU945lvoZ3yY8FoRFDC3YpwF8=
808808
github.com/snyk/container-cli v0.0.0-20240821111304-7ca1c415a5d7/go.mod h1:38w+dcAQp9eG3P5t2eNS9eG0reut10AeJjLv5lJ5lpM=
809-
github.com/snyk/error-catalog-golang-public v0.0.0-20250218074309-307ad7b38a60 h1:iB6z2BhBpfN9p0/dEZfwWvs7fpdZk3loooAih8yspS8=
810-
github.com/snyk/error-catalog-golang-public v0.0.0-20250218074309-307ad7b38a60/go.mod h1:Ytttq7Pw4vOCu9NtRQaOeDU2dhBYUyNBe6kX4+nIIQ4=
809+
github.com/snyk/error-catalog-golang-public v0.0.0-20250310083934-7ac627e3451f h1:plWVxooZeV6rTxu5BXYCe6p9z48r5egblbYM9VW4tvY=
810+
github.com/snyk/error-catalog-golang-public v0.0.0-20250310083934-7ac627e3451f/go.mod h1:Ytttq7Pw4vOCu9NtRQaOeDU2dhBYUyNBe6kX4+nIIQ4=
811811
github.com/snyk/go-application-framework v0.0.0-20250325133828-3ffd1aa4f76f h1:1EPrRhLQ5Bo0SmIqoAU38Et1Bv2klCbyfgLmVJfUyvM=
812812
github.com/snyk/go-application-framework v0.0.0-20250325133828-3ffd1aa4f76f/go.mod h1:A7oFVjMjNukzsMeiIWXEXjCrAf2ARvoK4aQOm9e3E/Y=
813813
github.com/snyk/go-httpauth v0.0.0-20240307114523-1f5ea3f55c65 h1:CEQuYv0Go6MEyRCD3YjLYM2u3Oxkx8GpCpFBd4rUTUk=
@@ -997,8 +997,8 @@ golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
997997
golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
998998
golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
999999
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
1000-
golang.org/x/mod v0.23.0 h1:Zb7khfcRGKk+kqfxFaP5tZqCnDZMjC5VtUBs87Hr6QM=
1001-
golang.org/x/mod v0.23.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
1000+
golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
1001+
golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
10021002
golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
10031003
golang.org/x/net v0.0.0-20180811021610-c39426892332/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
10041004
golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -1258,8 +1258,8 @@ golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
12581258
golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
12591259
golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
12601260
golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
1261-
golang.org/x/tools v0.30.0 h1:BgcpHewrV5AUp2G9MebG4XPFI1E2W41zU1SaqVA9vJY=
1262-
golang.org/x/tools v0.30.0/go.mod h1:c347cR/OJfw5TI+GfX7RUPNMdDRRbjvYTS0jPyvsVtY=
1261+
golang.org/x/tools v0.31.0 h1:0EedkvKDbh+qistFTd0Bcwe/YLh4vHwWEkiI0toFIBU=
1262+
golang.org/x/tools v0.31.0/go.mod h1:naFTU+Cev749tSJRXJlna0T3WxKvb1kWEx15xA4SdmQ=
12631263
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
12641264
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
12651265
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

‎test/fixtures/nuget-sln/Service.sln

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
2+
Microsoft Visual Studio Solution File, Format Version 12.00
3+
# Visual Studio Version 17
4+
VisualStudioVersion = 17.0.31903.59
5+
MinimumVisualStudioVersion = 10.0.40219.1
6+
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Service", "Service\Service.csproj", "{C5233795-FDA6-43C6-A5A0-DF697FE85908}"
7+
EndProject
8+
Global
9+
GlobalSection(SolutionConfigurationPlatforms) = preSolution
10+
Debug|Any CPU = Debug|Any CPU
11+
Release|Any CPU = Release|Any CPU
12+
EndGlobalSection
13+
GlobalSection(SolutionProperties) = preSolution
14+
HideSolutionNode = FALSE
15+
EndGlobalSection
16+
GlobalSection(ProjectConfigurationPlatforms) = postSolution
17+
{C5233795-FDA6-43C6-A5A0-DF697FE85908}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
18+
{C5233795-FDA6-43C6-A5A0-DF697FE85908}.Debug|Any CPU.Build.0 = Debug|Any CPU
19+
{C5233795-FDA6-43C6-A5A0-DF697FE85908}.Release|Any CPU.ActiveCfg = Release|Any CPU
20+
{C5233795-FDA6-43C6-A5A0-DF697FE85908}.Release|Any CPU.Build.0 = Release|Any CPU
21+
EndGlobalSection
22+
EndGlobal

‎test/fixtures/nuget-sln/Service/Class1.cs

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
namespace Service;
2+
3+
public class Class1
4+
{
5+
6+
}

‎test/fixtures/nuget-sln/Service/Service.csproj

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
<Project Sdk="Microsoft.NET.Sdk">
2+
3+
<PropertyGroup>
4+
<TargetFramework>net8.0</TargetFramework>
5+
<ImplicitUsings>enable</ImplicitUsings>
6+
<Nullable>enable</Nullable>
7+
</PropertyGroup>
8+
9+
<ItemGroup>
10+
<PackageReference Include="Humanizer" Version="2.14.1" />
11+
</ItemGroup>
12+
13+
</Project>

‎test/fixtures/nuget-sln/Service/obj/Service.csproj.nuget.dgspec.json

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
{
2+
"format": 1,
3+
"restore": {
4+
"/app/Service/Service.csproj": {}
5+
},
6+
"projects": {
7+
"/app/Service/Service.csproj": {
8+
"version": "1.0.0",
9+
"restore": {
10+
"projectUniqueName": "/app/Service/Service.csproj",
11+
"projectName": "Service",
12+
"projectPath": "/app/Service/Service.csproj",
13+
"packagesPath": "/home/builder/.nuget",
14+
"outputPath": "/app/Service/obj/",
15+
"projectStyle": "PackageReference",
16+
"configFilePaths": [
17+
"/home/builder/.nuget/NuGet/NuGet.Config"
18+
],
19+
"originalTargetFrameworks": [
20+
"net8.0"
21+
],
22+
"sources": {
23+
"https://api.nuget.org/v3/index.json": {}
24+
},
25+
"frameworks": {
26+
"net8.0": {
27+
"targetAlias": "net8.0",
28+
"projectReferences": {}
29+
}
30+
},
31+
"warningProperties": {
32+
"warnAsError": [
33+
"NU1605"
34+
]
35+
},
36+
"restoreAuditProperties": {
37+
"enableAudit": "true",
38+
"auditLevel": "low",
39+
"auditMode": "direct"
40+
}
41+
},
42+
"frameworks": {
43+
"net8.0": {
44+
"targetAlias": "net8.0",
45+
"dependencies": {
46+
"Humanizer": {
47+
"target": "Package",
48+
"version": "[2.14.1, )"
49+
}
50+
},
51+
"imports": [
52+
"net461",
53+
"net462",
54+
"net47",
55+
"net471",
56+
"net472",
57+
"net48",
58+
"net481"
59+
],
60+
"assetTargetFallback": true,
61+
"warn": true,
62+
"frameworkReferences": {
63+
"Microsoft.NETCore.App": {
64+
"privateAssets": "all"
65+
}
66+
},
67+
"runtimeIdentifierGraphPath": "/usr/share/dotnet/sdk/8.0.407/PortableRuntimeIdentifierGraph.json"
68+
}
69+
}
70+
}
71+
}
72+
}

‎test/fixtures/nuget-sln/Service/obj/Service.csproj.nuget.g.props

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
<?xml version="1.0" encoding="utf-8" standalone="no"?>
2+
<Project ToolsVersion="14.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<PropertyGroup Condition=" '$(ExcludeRestorePackageImports)' != 'true' ">
4+
<RestoreSuccess Condition=" '$(RestoreSuccess)' == '' ">True</RestoreSuccess>
5+
<RestoreTool Condition=" '$(RestoreTool)' == '' ">NuGet</RestoreTool>
6+
<ProjectAssetsFile Condition=" '$(ProjectAssetsFile)' == '' ">$(MSBuildThisFileDirectory)project.assets.json</ProjectAssetsFile>
7+
<NuGetPackageRoot Condition=" '$(NuGetPackageRoot)' == '' ">/home/builder/.nuget</NuGetPackageRoot>
8+
<NuGetPackageFolders Condition=" '$(NuGetPackageFolders)' == '' ">/home/builder/.nuget</NuGetPackageFolders>
9+
<NuGetProjectStyle Condition=" '$(NuGetProjectStyle)' == '' ">PackageReference</NuGetProjectStyle>
10+
<NuGetToolVersion Condition=" '$(NuGetToolVersion)' == '' ">6.11.1</NuGetToolVersion>
11+
</PropertyGroup>
12+
<ItemGroup Condition=" '$(ExcludeRestorePackageImports)' != 'true' ">
13+
<SourceRoot Include="/home/builder/.nuget/" />
14+
</ItemGroup>
15+
</Project>

‎test/fixtures/nuget-sln/Service/obj/Service.csproj.nuget.g.targets

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
<?xml version="1.0" encoding="utf-8" standalone="no"?>
2+
<Project ToolsVersion="14.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003" />

0 commit comments

Comments
 (0)